Loading…
Loading…
We use the minimum needed to keep you signed in and the site functional. No advertising cookies, ever. Analytics is opt-in and the consent check fails closed: if we cannot read your choice, analytics stays off. Last updated: 2026-08-14.
01 · Cookies we set
Every cookie this site sets, including the two third parties that set their own. The last column names the file that sets it, so you can check this table against the code rather than take our word for it.
| Cookie | Category | Purpose | Set by / duration |
|---|---|---|---|
Session cookies set by our authentication providerapp/layout.tsx (ClerkProvider) | Strictly necessary | Keeps you signed in and lets server routes identify you. Without these you cannot use an account. | Clerk, on our behalf Session and short-lived refresh cookies, managed by the provider. |
__Host-anon-session-idlib/csrf.ts | Strictly necessary | Identifies a signed-out browser so rate limits and request-integrity checks can be applied without an account. HttpOnly, Secure and SameSite=Strict, and the __Host- prefix means the browser refuses to set it from JavaScript or from another subdomain. | AGI Automation LLC 24 hours. |
agiworkforce-languageapp/i18n/index.ts | Strictly necessary | Remembers your chosen interface language so the server renders the same locale you saw last time. | AGI Automation LLC 1 year. |
_ga and _ga_*shared/components/AnalyticsConsentGate.tsx | Analytics | Google Analytics page-view and session measurement. These are set only after you opt in, and are not set at all until then. | Google Up to 2 years, set by Google. |
__stripe_mid, __stripe_sidfeatures/billing/services/stripe-payments.ts | Payment | Fraud prevention on card payments. Set by Stripe when their payment script loads, which happens only at the moment you confirm a payment, not while you browse, and not on the pricing page. If you never pay, they are never set. | Stripe Up to 1 year (mid) and 30 minutes (sid), set by Stripe. |
We set no advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioural advertising. Only the analytics row needs your consent; the rest are necessary to keep you signed in, keep the site functional, or complete a payment you asked for.
02 · What else we put on your device
A cookie policy that only lists cookies is answering a narrower question than the one you asked. Most of what this product stores on your device is in local or session storage, not cookies, including your session credentials. None of it is a tracking technology and none of it is shared, but you should be able to see it, so here it is in full. The ones that carry an identifier or a credential are listed first.
| Key | Where | What it holds | Cleared by |
|---|---|---|---|
user_idshared/lib/sentry.ts | Local storage | Your account identifier, so a crash report can be tied to a session. Written by the error-reporting wrapper. It is an identifier, which is why it is listed first rather than buried. | Signing out, or clearing site data. |
agi_secure_keyshared/lib/security.ts | Local storage | A marker that a browser-held encryption key exists for this session. Not the key itself: the key material is non-extractable and held by the browser. | Clearing site data. |
cookie-consentshared/lib/cookie-consent.ts | Local storage | Your analytics choice. Never sent to us. Anything unreadable counts as no decision, which means analytics stays off. | Clearing site data, which resets you to analytics off. |
agi.privacy.shareTelemetrylib/sentry-shared.ts | Local storage | A device-local mirror of your error-reporting preference, so the choice applies before the server answers. Off unless you turn it on. | Clearing site data. |
agi-artifacts-storefeatures/chat/stores/artifacts-store.ts | Local storage | Artifacts you have open, cached so they survive a reload. This can contain content you generated. | Clearing site data. |
agi_last_activityshared/hooks/useSessionTimeout.ts | Local storage | A timestamp of your last interaction, used to time out an idle session. | Signing out, or clearing site data. |
theme, theme-preferencepublic/theme-init.js | Local storage | Light, dark or system. Read before first paint so the page does not flash the wrong theme. | Clearing site data. |
agiworkforce-languageapp/i18n/index.ts | Local storage | The same locale choice as the cookie above, cached for the client. | Clearing site data. |
agi:tts-voice-urilib/hooks/useTTS.ts | Local storage | Which system voice you picked for read-aloud. | Clearing site data. |
agi.terms-accepted-versionapp/signup/TermsGate.tsx | Session storage | The revision of the terms you ticked, so signing in with a provider that leaves the page and returns does not lose the click. It is consumed once the account records your acceptance. | Closing the tab, or completing sign-up. |
agi.team.invitation-tokenfeatures/teams/components/TeamInvitationAcceptance.tsx | Session storage | An invitation token carried across the sign-in redirect so the invite still applies when you land back. | Closing the tab, or accepting the invitation. |
Local storage survives closing the browser; session storage does not. Clearing site data in your browser removes both, and will sign you out.
03 · Two things people usually get told wrong
Our cross-site request protection is a token carried in a request header and bound to your session, not a cookie. Earlier versions of this page listed a “CSRF token” cookie. Nothing set one, so it is gone.
It is stored in your browser’s local storage under the key cookie-consent, on your device only. It is never sent to us. Clearing site data resets it to the default, which is analytics off.
04 · Do Not Track and Global Privacy Control
We do not read either signal today. Browsers can send a Do Not Track header or a Global Privacy Control signal, and nothing in this product currently checks for them. We are stating that plainly rather than leaving you to assume one way or the other, because a site that silently ignores GPC while implying otherwise is worse than one that says so.
What this does and does not cost you: analytics is opt-in here regardless, so a browser sending GPC already gets the outcome it is asking for: nothing loads until you turn it on. The signal would matter for a sale or sharing of personal data for advertising, and we do neither. Reading the signal explicitly is tracked as an open item.
05 · Your choices
at any time: analytics stays off until you turn it on, and switching it back off stops it loading on your next page view. You can also manage cookies through your browser; clearing them will sign you out of any active session. For data export or deletion, see the privacy policy.