> This page is for version 🇺🇸 US.
> For other versions, use one of these documentation indexes:
> - 🇦🇺 AU (default): https://docs.humanapproved.com/au/llms.txt
> - 🇬🇧 UK: https://docs.humanapproved.com/uk/llms.txt
> - 🇺🇸 US: https://docs.humanapproved.com/us/llms.txt

> This is HumanApproved's documentation, as Markdown for AI agents. /llms.txt lists every page; /llms-full.txt has them all. If you're helping someone integrate HumanApproved, start with /guides/ai-coding-agents.

# Browser support and storage

> The HumanApproved embed's requirements, Content Security Policy compatibility, and the data it stores in sessionStorage and localStorage.

## Requirements

* **Small and self-contained.** No runtime dependencies, under 15 KB gzipped, built to ES2020.
* **Works under a strict Content Security Policy and Trusted Types.** Nothing inline, no `eval`, no `innerHTML`. The panel's styles are a constructed stylesheet inside a closed shadow root. See [Content Security Policy](/us/guides/content-security-policy).
* **Fails open.** Unless HumanApproved returns `review`, the step proceeds within 2.5 seconds (or your [`timeoutMs`](/us/embed/sdk/options#timeoutms)).
* **HTTPS for approvals.** The embed uses the browser's Web Crypto API for the quote details, which is only available on secure (HTTPS) pages. Without it, the step proceeds and the browser console shows the reason.

## What it keeps in the browser

The embed uses two storage keys:

| Storage          | Key                     | What's in it                                                                                                                                                                                                                                                                                  | How long                    |
| ---------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| `sessionStorage` | `agent-signals:journey` | Behaviour counts and timings for the visit, the current page's path, any review in progress or approved (with a hash of the quote details, not the details), any check that got no response, and the journey's quote (the start of the quote reference), so a new quote starts a new journey. | Cleared when the tab closes |
| `localStorage`   | `agent-signals:visitor` | A random ID that links journeys from one browser.                                                                                                                                                                                                                                             | Until cleared               |

`userId` is never kept in the browser's storage.

## What it sends

Each check sends:

* the random browser ID,
* your `userId`, if you set one,
* after a check that got no response, the reason and time,
* the journey's behaviour counts and timings,
* general device characteristics: screen size, time zone, language, window size, font and device counts, and graphics class.

It never reads what's typed, which keys are pressed, or where the pointer is, and never sends names or page paths: the path stays in the tab's storage.

On a review, the embed also sends the quote and mobile from your `quoteDetails()`, so the customer can approve them.

> **Warning**
>
> Name the storage and the data sent in your privacy notice and cookie policy before you go live.