Does a chat analyser use cookies, and which ones?

Portraitor sets one cookie of its own, which keeps a Pass active for up to 30 days. Two more are set by other companies: a fraud prevention cookie from its payment processor lasting up to a year, and Google Analytics cookies lasting up to two years. If your browser sends Global Privacy Control or Do Not Track, the analytics cookies are not set at all.

Most tools in this category answer the cookie question with a sentence about caring deeply about your privacy. The useful version of the answer is a table: which cookies, set by whom, for how long, and what happens if you say no. Portraitor publishes one, and the figures below were read from its privacy policy on 28 October 2026.

The answer is not that there are no cookies. There are three kinds, and one of them is analytics. A page that told you otherwise would be easy to check and wrong.

Three cookies, and what each one is for

The policy’s cookie section lists them with an owner and a duration against each. The first keeps a Pass active as you move between pages, so the code need not be entered again on every page. Portraitor sets it, and it lasts up to 30 days.

The second is set by the payment processor and is used to detect fraudulent activity on payments. It lasts up to a year. The third is Google Analytics, which the policy says distinguishes visitors and sessions so the company can see how the site is used. Those last up to two years.

The policy also states what it does not do with them: it does not use cookies to advertise. That is a narrower claim than tracker free, and it is the one the page can actually support.

The analytics cookies last up to two years

Two years is the longest duration in the table and it belongs to the one cookie that is not needed for the service to work. The policy is specific about what Google Analytics receives: pages visited, the referring site, device and browser type, and an approximate location. It says plainly that it never receives your conversation.

That distinction matters more than it sounds. The conversation itself is handled on a different path entirely, described in is it safe to upload your chat history. The analytics cookie is about your visit to the website, not about the text you submit.

Global Privacy Control stops them being set at all

The policy says Portraitor honours the Global Privacy Control and Do Not Track signals, and that if your browser sends either of them, the analytics cookies are not set at all. Not set later, not set and then ignored. Not set.

That is an unusually clean commitment, because both signals are easy to send and easy to verify. Global Privacy Control is built into some browsers and available as an extension in others, and the policy lists two further routes to the same result: Google’s own browser opt out add on, and simply blocking cookies for the site in your browser.

Where a company offers a signal it is not legally obliged to honour everywhere, and says what the signal does in one sentence, you can check the claim yourself in about a minute. That is worth more than a longer paragraph you cannot test.

The payment script runs on every page, not only the checkout

This is the part of the policy most companies would leave out. It states that the payment processor’s script is loaded on all pages of the site rather than on payment pages alone, and that it collects device information for the purpose of fraud prevention.

So the fraud prevention cookie is not confined to the moment you pay. The policy gives the reason rather than hiding the fact, which is the right way round, but a reader who assumed the payment machinery only appeared at checkout should know it does not.

The same section covers the content delivery provider, which receives your IP address when a page loads and when your browser downloads the privacy filter. The policy adds that card details never pass through it and never reach Portraitor’s own servers either, going from your browser directly to the payment processor.

Portrait history is browser storage, not a cookie

The policy draws a line here that is easy to miss. Your portrait history, meaning the conversations you submit and the results returned to you, is held in your browser’s own storage rather than in a cookie, and is not transmitted. Where that lives and how to clear it is covered in where your portrait is saved.

A cookie travels back to a server on every request. Browser storage does not, unless a page deliberately reads it and sends it. The policy’s claim is that nothing sends it. That is why the history survives a refresh but disappears when you clear the site’s data.

The service also operates no user accounts at all, which removes a whole category of tracking before cookies are even discussed. That arrangement is set out in chat analysis without an account.

Reading a cookie table before you buy

The question worth asking of any tool in this category is not whether it uses cookies, because almost all of them do. It is whether the page naming them agrees with what the site actually loads, and whether the company says what happens when you object.

Portraitor’s answer is three cookies, two of them belonging to other companies, with durations stated, an analytics cookie that is switched off entirely by a signal your browser can send, and a payment script that is admitted to run site wide. Whether that is acceptable is your call, but it is a checkable description rather than a reassuring one.

If the comparison you are making is specifically about data handling across several tools, the most private chat analyser sets out where each one puts its conversation data, and who else receives your chat covers the third parties behind the scenes. If you want to remove what a tool holds, deleting your data from a chat analyser goes through the routes. You can see what Portraitor itself produces at Portraitor.

Frequently asked questions

Frequently asked questions

A cookie table you can check beats a privacy promise you cannot.

Sources

1. Portraitor, Privacy Policy version 1.3, section 6.