Cookies.

• Session cookies set by our authentication providerStrictly necessary. Keeps you signed in and lets server routes identify you. Without these you cannot use an account.
  Clerk, on our behalf · Session and short-lived refresh cookies, managed by the provider. · lib/identity/provider.tsx (ClerkProvider)
• __Host-anon-session-idStrictly necessary. Identifies a signed-out browser so rate limits and request-integrity checks can be applied without an account. HttpOnly, Secure and SameSite=Strict, and the __Host- prefix means the browser refuses to set it from JavaScript or from another subdomain.
  AGI Automation LLC · 24 hours. · lib/anonymous-session.ts
• agi_referralFunctional. Set only when you open a referral link. Remembers the referral code so that, if you then create an account, the referral can be applied to it. HttpOnly and SameSite=Lax, and cleared once the referral has been evaluated for your new account.
  AGI Automation LLC · 30 days, or until it has been applied. · app/r/[code]/route.ts
• agiworkforce-languageStrictly necessary. Remembers your chosen interface language so the server renders the same locale you saw last time.
  AGI Automation LLC · 1 year. · app/i18n/index.ts
• _ga and _ga_*Analytics. Google Analytics page-view and session measurement. These are set only after you opt in, and are not set at all until then.
  Google · Up to 2 years, set by Google. · shared/components/AnalyticsConsentGate.tsx
• __stripe_mid, __stripe_sidPayment. Fraud prevention on card payments. Set by Stripe when their payment script loads, which happens only at the moment you confirm a payment, not while you browse, and not on the pricing page. If you never pay, they are never set.
  Stripe · Up to 1 year (mid) and 30 minutes (sid), set by Stripe. · features/billing/services/stripe-payments.ts

We set no advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioural advertising. Only the analytics row needs your consent; the rest are necessary to keep you signed in, keep the site functional, apply a referral link you opened, or complete a payment you asked for.

• cookie-consentLocal storage. Your analytics choice. Never sent to us. Anything unreadable counts as no decision, which means analytics stays off. A browser sending Global Privacy Control overrides whatever is stored here.
  Cleared by: Clearing site data, which resets you to analytics off. · shared/lib/cookie-consent.ts
• agi.notice.free-plan-trainingLocal storage. A one-way fingerprint of each account that has seen the Free plan notice about free model providers, not the account id itself, so the notice is shown once per account rather than on every visit. Signing out keeps it. Never sent to us.
  Cleared by: Clearing site data, which shows the notice again. · features/chat/components/FreePlanTrainingNotice.tsx
• agi.notice.free-model-promotion.<model>.<end date>Local storage. A one-way fingerprint of each account that has seen the notice that a model is free for a limited time, not the account id itself, so each offer is announced once per account. Signing out keeps it. Never sent to us.
  Cleared by: Clearing site data, which shows the notice again. · features/chat/components/FreeModelPromotionNotice.tsx
• agi.privacy.shareTelemetryLocal storage. A device-local mirror of your error-reporting preference, so the choice applies before the server answers. Off unless you turn it on.
  Cleared by: Clearing site data. · lib/sentry-shared.ts
• agi-user-profile-storeLocal storage. A cached copy of your account profile so the app can render before the server answers: your name, email, avatar, and your plan and its renewal dates. It is a copy of what we already hold, not a separate collection.
  Cleared by: Signing out, or clearing site data. · shared/stores/user-profile-store.ts
• agi-artifacts-storeLocal storage. Artifacts you have open, cached so they survive a reload. This can contain content you generated.
  Cleared by: Clearing site data. · features/chat/stores/artifacts-store.ts
• agiworkforce-web-settingsLocal storage. Your app settings, including any custom commands you wrote. Those are your own text, held on your device.
  Cleared by: Signing out, or clearing site data. · shared/stores/web-settings-store.ts
• agi-notification-storeLocal storage. In-app notifications you have received, their read state, and your notification settings.
  Cleared by: Signing out, or clearing site data. · shared/stores/notification-store.ts
• agi-company-hub-storeLocal storage. Your AGI Work sessions and which one is active.
  Cleared by: Signing out, or clearing site data. · shared/stores/company-hub-store.ts
• agent-metrics-storageLocal storage. Counters the app keeps for you about your own runs: sessions, completed and failed tasks, tokens and messages, and recent activity. Device-local, never sent to us, and not the metering we bill from.
  Cleared by: Signing out, or clearing site data. · shared/stores/agent-metrics-store.ts
• agi-tool-permissionsLocal storage. The allow, ask and block verdicts you saved for individual tools.
  Cleared by: Signing out, or clearing site data. · features/connectors/stores/tool-permissions-store.ts
• agiworkforce-web-chatLocal storage. Your model choice, the sidebar state, and the standing per-conversation decisions you made: which connectors a chat may not reach, whether Memory is off for it, and whether it is a Chat or an AGI Work thread. No message text.
  Cleared by: Signing out, or clearing site data. · shared/stores/web-chat-store.ts
• agi-model-store, agi-response-style, agi-thinking-store, agi-ui-store, tool-storageLocal storage. Interface preferences with no personal data in them: the model and provider you last picked, your response style, your thinking-effort setting, panel and layout state, and your tool filters and trusted workflows.
  Cleared by: Signing out, or clearing site data. · shared/stores/model-store.ts, features/chat/stores/style-store.ts, shared/stores/thinking-store.ts, shared/stores/layout-store.ts, shared/stores/tool-store.ts
• agi_last_activityLocal storage. A timestamp of your last interaction, used to time out an idle session.
  Cleared by: Signing out, or clearing site data. · shared/hooks/useSessionTimeout.ts
• theme, theme-preferenceLocal storage. Light, dark or system. Read before first paint so the page does not flash the wrong theme.
  Cleared by: Clearing site data. · public/theme-init.js
• agiworkforce-languageLocal storage. The same locale choice as the cookie above, cached for the client.
  Cleared by: Clearing site data. · app/i18n/index.ts
• agi:tts-voice-uriLocal storage. Which system voice you picked for read-aloud.
  Cleared by: Clearing site data. · lib/hooks/useTTS.ts
• agi.terms-accepted-version, agi.marketing-email-notice-version, agi.marketing-email-attempt-idLocal storage. The revision of the terms you accepted and, only if you tick the marketing email box, the privacy notice revision and a random identifier for that sign-up attempt. They carry your choices across a provider sign-up redirect.
  Cleared by: Completing sign-up, using Edit email, starting a provider or passkey sign-in, signing out or clearing site data. · app/signup/signupAttemptMarkers.ts
• agi.marketing-email-attempt-idSession storage. The same random identifier, kept in this tab only, so a marketing email choice is recorded only for the sign-up it was ticked in, and a choice another tab removed is asked again.
  Cleared by: Closing the tab, completing sign-up, using Edit email, starting a provider or passkey sign-in, signing out or clearing site data. · app/signup/signupAttemptMarkers.ts
• agi.team.invitation-tokenSession storage. An invitation token carried across the sign-in redirect so the invite still applies when you land back.
  Cleared by: Closing the tab, or accepting the invitation. · features/teams/components/TeamInvitationAcceptance.tsx
• __storage_test__Local storage. Nothing readable. It is written and removed again in the same breath, to find out whether this browser allows local storage at all before anything tries to use it.
  Cleared by: Removed immediately by the check that wrote it. · shared/utils/browser-utils.ts
• Everything else, under an agi or agiworkforce prefixLocal storage. Interface state with no personal data in it: which model favourites you starred, which notices and banners you dismissed, which conversations are unread, and which interface variants you are on. Every remaining key the app writes carries one of those two prefixes, which is how the sign-out sweep finds them all. Nothing outside that prefix and outside this table is written by us.
  Cleared by: Signing out, or clearing site data. · shared/stores/authentication-store.ts (APP_STORAGE_KEY_PATTERNS)

Local storage survives closing the browser; session storage does not. Clearing site data in your browser removes both, and will sign you out.

03 · Two things people usually get told wrong.

04 · Do Not Track and Global Privacy Control.

We honour Global Privacy Control. When a consent request sends the Sec-GPC header, new optional-purpose grants are recorded as refusals. These include the account choice “Email me product news, tips and offers.” and waitlist product updates. The sign-up box is also held off when navigator.globalPrivacyControl is true, with “Held off by this browser's Global Privacy Control.” beside it. An existing account grant shown in Settings is not automatically erased by this browser signal; you can withdraw it there or in the consent centre. The browser signal also refuses the product-update list in the consent centre.

For analytics, the signal is a refusal. That refusal wins over an acceptance stored in this browser, so an earlier “allow analytics” choice stops applying for as long as the signal is on, and the analytics switch in cookie preferences is shown off and locked with the reason beside it.

What it does not do: it never touches the strictly necessary cookies in the table above, so it cannot sign you out or keep you from signing in. Do Not Track is a separate, older header with no agreed meaning and we still do not read it; the outcome it asks for is the one Global Privacy Control now gets. We do not sell or share personal data for advertising, and honouring the signal does not depend on that.

05 · Your choices.

Change your cookie preferences at any time: analytics stays off until you turn it on, and switching it back off stops it loading on your next page view. You can also manage cookies through your browser; clearing them will sign you out of any active session. For data export or deletion, see the privacy policy.