Legal
Cookie policy.
One cookie, and only if you sign in - cyrus.ai sets exactly one cookie, and only when you sign in: cyrus.session, the signed record that you are logged in. There are no analytics cookies, no advertising cookies, no consent banner - browsing the catalog drops nothing on your device.
Last updated: 24 October 2026
What we use instead: localStorage
Apart from the session cookie, everything is persisted with the browser's localStorage API, under keys prefixed agenthub.*. The difference matters: those values are sent to no server automatically, cannot be read cross-domain, and are deleted the moment you clear site data.
- Saved projects and followed organizations.
- A local copy of your display name and sign-in provider, so the dashboard opens for you offline.
- Theme and dashboard notification preferences.
Third-party storage
The Google redirect lets accounts.google.com use its own cookies and storage while you are on Google's page; that is governed by Google's privacy policy, not ours, and the only things we keep afterwards are your name, email, avatar URL and account id in the session we sign. Email sign-in loads nothing third-party unless a Cloudflare verification widget is configured on the deployment, and it is not configured today.
Managing or deleting your data
Everything local is one action away: open your browser's site settings for this domain and clear storage, or use the remove buttons on the dashboard for individual saves. The session cookie is one action away too - press sign out. Nothing else of yours sits on a server.
If this ever changes
If a future version introduces a cookie that is not the session, or any tracking technology, this page is rewritten first and a real consent mechanism goes live with it. Today: one cookie, only on sign-in, nothing that follows you anywhere else.
Other documents
The full legal set for cyrus.ai, all written for what the site actually does.