# Cookie Policy · Agenstry

# Cookie Policy

Last updated: 2026-08-05

This page lists every cookie Agenstry's web app may set on your device,
what each one does, how long it lives, and whether it requires your consent.
For context on what we collect more broadly, see the [privacy policy](/privacy).

You can change your consent at any time using the
[cookie preferences](#) link
in the footer, or via the buttons below.

Open cookie preferences
Reject all non-essential

## How we think about cookies

Agenstry runs on a deliberately small cookie surface. We do not use Google
Analytics or third-party product-behaviour analytics. We do load the Google
tag for Ads conversion measurement under Consent Mode v2. Advertising storage
and personalization remain denied unless you explicitly accept Marketing, and
no personal data is sent to Google in either case.

## Categories

### 1. Strictly necessary

Required for the site to
function. Set automatically; cannot be disabled because nothing on the site
would work without them.

| Cookie | Purpose | Duration | Type |
| --- | --- | --- | --- |
| `session` | Keeps you signed in. HttpOnly, signed, Secure in production. | 14 days | First-party |
| `ac_consent` | Remembers your cookie choices so we don't ask again. | 180 days | First-party |
| `onboard_*` | Tracks progress through the agent-onboarding flow so a refresh doesn't lose your place. | Session | First-party |
| `__stripe_*` | Set by Stripe Checkout on the checkout page only, for fraud prevention. See [Stripe's cookie policy](https://stripe.com/cookie-settings). | Up to 1 year | Third-party (Stripe) |

### 2. Analytics & attribution

Helps Agenstry understand which
campaigns and referrers send traffic. Only set after you accept this
category. No third-party analytics scripts run; data stays on Agenstry's
servers.

| Cookie | Purpose | Duration | Type |
| --- | --- | --- | --- |
| `agf_utm` | First-touch attribution. Stores bounded `utm_source/medium/campaign` values, the first landing path, and only a non-reversible HMAC hash of any Google or Microsoft advertising click ID. Raw click IDs are not retained. Used only in our own dashboards; never shared. | 30 days | First-party |

### 3. Marketing

Used for Google Ads conversion
tracking and remarketing measurement so we can see which campaigns turn into
sign-ups and improve them. The Google tag (gtag.js) loads on every page but
runs in **Consent Mode v2 with `ad_storage` denied**
until you accept this category — meaning no first-party Google Ads cookies
are written, no `ad_user_data` leaves your browser, and pings to
Google are cookieless consent-status and measurement pings without advertising
cookie identifiers, which Google may use for aggregate conversion modelling.
Flipping this toggle on grants `ad_storage`,
`ad_user_data`, and `ad_personalization` for the
duration of the consent cookie (180 days by default). Provider: Google
Ireland Ltd. (EU data-processor under SCC).

We measure four product
milestones this way: completing a sign-up, starting an agent claim, creating
your first API key, and starting checkout. A conversion carries only the
conversion label, a currency, a value (zero for everything except a completed
subscription), and a salted one-way hash we use to stop a page reload counting
twice. **No personal data is sent to Google** — not your email
address, not your account ID. Enhanced conversions, which would have sent a
hashed email address, are deliberately switched off.

## What about local storage?

Agenstry stores a handful of preferences in your browser's
`localStorage`: your theme choice (light/dark), the chat history
for the enterprise AI sandbox, and a mirror of your cookie consent. These
are not cookies and are not sent to our servers; they live entirely on your
device and are wiped when you clear browser data for the site.

## How to change your mind

- Re-open the picker via [cookie preferences](#) (also linked in the footer of every page).
- Clear all Agenstry cookies in your browser settings to be re-prompted on next visit.
- For full account deletion or a data export, email [hello@agenstry.com](mailto:hello@agenstry.com). We respond within 30 days under GDPR.

## Contact

Agenstry · [hello@agenstry.com](mailto:hello@agenstry.com)