AOV uses strictly necessary first-party cookies for sign-in, CSRF protection, callback handling, and active workspace context. No analytics, advertising, session replay, or cross-site tracking scripts are loaded.