Introduction
This statement covers the Aletheia marketing site at aletheia.lonia.ai. It is published under the ePrivacy Directive 2002/58/EC (as amended), which applies alongside the General Data Protection Regulation for services directed at users in the European Union. Under that Directive, any cookie or similar storage that is not strictly necessary to deliver a service the user has requested requires the user's consent before it is set. Cookies that are strictly necessary, such as those needed for session management, security, or authentication, are exempt from the consent requirement but are still documented here.
The Aletheia marketing site relies on none of these mechanisms. It sets no cookies at all, stores nothing in your browser, and contacts no third-party host when you load a page.
How this was verified
The zero-cookie claim is not a promise made from reading the code. It is the result of a runtime audit. Every public route on this site was loaded in a fresh, isolated browser session, and after each page finished loading we enumerated every place a tracker could hide: cookies (including those a server can set that scripts cannot read), localStorage, sessionStorage, IndexedDB databases, Service Worker registrations, and every network request the page made, separating our own domain from any third party.
Across all 31 audited routes, the audit observed zero cookies, zero localStorage and sessionStorage entries, zero IndexedDB databases, no Service Worker, and zero requests to any third-party host. The only host contacted was our own origin, serving the page, its stylesheet, and its images. The audit was re-run on October 16, 2026, covering all 31 public routes of site revision c2b6329aa097, and the record is published in the site repository at test-results/cookie-audit-2026-10-16.json. The revision is named rather than called the current one, because a sentence that says "current" re-asserts itself on every build without anyone deciding to, which is how this claim came to describe a build the audit had not seen.
"Every public route" is not a claim maintained by hand. The route list the audit walks is derived from the site's own page files, and the build fails if the published record does not cover every route the site builds, or if the coverage stated on this page does not match that record. That includes the routes excluded from the sitemap, such as the error page and the domain verification page, which are audited precisely because a page that loads a script is the one worth checking.
How Lonia's own subdomains are counted
Requests to Lonia-owned services on other subdomains of lonia.ai, for example aletheia-stripe-checkout.lonia.ai, are treated as first-party for the purpose of this statement. They are our own services, operated by us under this privacy policy and this cookies statement, not third parties. So "zero requests to any third-party host" means exactly that: no request to any host outside our control. It does not quietly exclude a cross-origin request to a service we run. For completeness: loading a page on this marketing site makes no cross-origin request at all, to a Lonia host or any other. The only page that can make one is the domain verification page, and only when an institution administrator follows a verification link, which posts the verification token to the relevant Lonia admin service.
What we do not do
On the marketing site, we do not load any of the following:
- Analytics cookies of any kind (Google Analytics, Plausible, Fathom, or any equivalent).
- Advertising or retargeting cookies.
- Social media pixels or share-button trackers (Meta, LinkedIn, X, or others).
- Session replay or heatmap tools.
- Third-party fonts, scripts, or tag managers loaded from an external content delivery network.
- Consent-management or cookie-banner scripts, which are unnecessary because there are no non-essential cookies to consent to.
Strictly necessary cookies in the signed-in product
The pages on this marketing site do not require you to sign in, so they set no session or authentication cookies. Those cookies exist only inside the signed-in Aletheia product, on its own application subdomain, and only after you choose to sign in.
When you sign in to the product with Google or Microsoft, the authentication provider maintains a session so that you stay signed in between page loads. That session storage is strictly necessary: without it, you could not use a feature you explicitly asked for, which is to be signed in. Under the ePrivacy Directive, strictly necessary session and authentication storage of this kind is exempt from the consent requirement. It is first-party, it is not used for cross-site tracking, and it does not apply to anyone who is only browsing this marketing site.
Third-party services
Some Lonia AI infrastructure is capable of setting a strictly necessary cookie in narrow circumstances, but none of it runs on this marketing site, and the runtime audit above confirms that.
- Cloudflare bot protection (Turnstile). Where a bot-protection challenge is presented, for example to guard a sign-in or a form submission inside the product, the challenge may briefly set a first-party session cookie to complete and remember the result of that specific challenge. That cookie is a strictly necessary security cookie under the ePrivacy exemption: it exists to protect the service against automated abuse, not to track you, and it carries no advertising or analytics function. No such challenge runs when you browse this marketing site, so no such cookie is set here.
- Everything else. The services that operate Aletheia, such as authentication, database, hosting, and payments, are documented in the Sub-processor list, and the recipients that can receive data connected to your use of Aletheia are listed in full in the Privacy Policy. None of them place a cookie or run a script on this marketing site.
Your controls
Because this site sets no cookies, there is nothing for you to clear here. For the strictly necessary cookies that the signed-in product may use, and for cookies from any other site you visit, every major browser lets you view and delete stored cookies and site data, block cookies, and browse in a private or incognito window. These controls are found in your browser's privacy or site-data settings. Clearing a strictly necessary product cookie simply signs you out of the product; it does not affect your ability to read this marketing site.
Change history
| Date | Version | Change |
|---|---|---|
| October 16, 2026 | 1.7 | Re-ran the runtime audit after a stylesheet fix. The footer's regions navigation had been painted over the first screen of every page at viewport widths of 768 pixels and below, because the mobile navigation drawer's rules were written with a bare element selector that matched the footer's navigation landmark as well as the drawer's. The audit result is unchanged across all 31 routes: zero cookies, zero client-side storage, zero third-party requests. It is re-run because this page names the site revision the run covered, and that revision moved. |
| October 4, 2026 | 1.6 | Re-ran the runtime audit and replaced "in the current build" with the site revision the run covered. The record the page cited was two weeks and ten commits older than the build being served, and the word "current" is what made that invisible: it re-asserted the claim on every build. Result unchanged across all 31 routes. |
| September 20, 2026 | 1.5 | Re-ran the runtime audit after the Healthcare Mode page was added, covering all 31 public routes. Result unchanged: zero cookies, zero client-side storage, and zero third-party requests on every route. The audit now records a response whose headers it could not read as a failure of the run rather than as an absence of cookies. |
| September 17, 2026 | 1.4 | Contact address consolidated to privacy@lonia.ai. |
| August 26, 2026 | 1.3 | Re-ran the runtime audit against the current build after a content revision, covering all 30 public routes then published. Result unchanged: zero cookies, zero client-side storage, and zero third-party requests on every route. The audit now also verifies which site is being served before it records anything, by reading the served page title and refusing to scan an origin that is not Aletheia. |
| August 23, 2026 | 1.2 | Re-ran the runtime audit against the build of that date, covering all 30 public routes then published. The previous run covered 25 of the 26 routes then published: the domain verification page had been added six days after that run and was never audited, while this page claimed coverage of every public route. The audit now derives its route list from the site's own page files, and the build fails if the published record does not cover every route. Result unchanged: zero cookies, zero client-side storage, and zero third-party requests on every route. Added an explicit statement of how Lonia's own subdomains are classified. |
| July 23, 2026 | 1.1 | Re-ran the runtime audit against the build of that date, covering 25 public routes, including the six added since initial publication. Result unchanged: zero cookies, zero client-side storage, and zero third-party requests on every route. |
| July 14, 2026 | 1.0 | Initial publication, backed by a runtime cookie audit confirming a zero-cookie, zero-tracker posture across the 19 public routes then published. |
Review cadence
Last review date: October 16, 2026. Next review: annually, or on any material change to the site's storage or network behavior, whichever comes first. A material change includes adding any script, embed, font, or service that loads from a third-party host, or introducing any cookie or client-side storage. On each review the runtime audit is re-run and this statement is updated to match what the audit observes.
Contact
Questions about this statement, or about cookies and tracking generally, can be sent to privacy@lonia.ai.