— COOKIE POLICY · v2.1 · MAY 1, 2026

We use almost none.
Aur jo use karte hain, neeche poori list hai.

Most cookie policies are 4,000 words and tell you nothing. Yeh policy 90% of the time bata rahi hai ke kya kya nahi hai. Khol DevTools, Application tab → Cookies. Is page par 0 cookies hain. Verify khud kar lo.

↓ WHY NO COOKIE BANNER

Banner sirf tab dikhana legally required hai jab non-essential cookies use ho.

This marketing site uses no non-essential cookies. So no banner. (GDPR Art. 5(3) ePrivacy carve-out for strictly necessary.)
The product uses 3 strictly-necessary + 1 user-set preference. Still no banner — these don't require consent.
Your CMS-style "Accept All / Reject All" prompts exist because most sites secretly run analytics + ad-tech that needs consent. We don't run those, so we don't need the prompt.
Honest is faster. No "manage preferences" maze that hides 47 vendor toggles behind a "legitimate interest" checkbox. Just don't drop the trackers in the first place.

— 03 / FULL LIST

— EVERY COOKIE WE SET, ANYWHERE

The complete inventory.

If you find anything in DevTools that isn't on this list, mail privacy@anilcyborg.com. We'll either add it (and apologise) or remove it within 24 hours.

On this marketing site (`anilcyborg.com`)

0 COOKIES

No cookies. None. Open DevTools → Application → Cookies for anilcyborg.com. The list is empty. We use Plausible Analytics (self-hosted, EU) for aggregate page views — it is fully cookieless and uses no client storage at all.

In the product (`app.anilcyborg.com`)

4 COOKIES

Cookie	Purpose	Type	Duration	Flags
`ac_session`	Authenticated session token. Without this, you cannot stay logged in.	ESSENTIAL	14 days (rolling)	HttpOnly · Secure · SameSite=Lax
`ac_csrf`	CSRF protection token for write requests. Stops cross-site request forgery.	ESSENTIAL	Session	HttpOnly · Secure · SameSite=Strict
`ac_workspace`	Remembers which workspace you last opened (multi-workspace users).	ESSENTIAL	30 days	Secure · SameSite=Lax
`ac_theme`	Stores light / dark / auto preference. You set it; we read it.	PREFERENCE	1 year	Secure · SameSite=Lax

All four are first-party. None are shared across domains. None feed analytics, ads, or profiling.

Local storage / IndexedDB (in the product)

3 KEYS

Key	Purpose	Type	Cleared on logout?
`ac.draft.*`	Auto-saves drafts of long-form Cyborg instructions	ESSENTIAL	Yes
`ac.layout`	Remembers your panel sizes, collapsed sections	PREFERENCE	No
`ac.cache.*`	Local cache of read-only resources for fast loads	ESSENTIAL	Yes

What we will never drop on you

FOREVER

Google Analytics, Adobe Analytics, Mixpanel, Segment, Amplitude — none.
Hotjar, FullStory, LogRocket, session-replay tools — none. Your screen is never recorded.
Meta pixel, Google Ads, LinkedIn Insight, TikTok pixel, Reddit pixel — none. We don't run paid ads.
Cross-domain identifiers like _ga, _fbp, fr, li_at — none.
Browser fingerprinting via canvas, WebGL, AudioContext, fonts — none. Try EFF's Cover Your Tracks.
3rd-party iframes that set cookies — none. We don't embed YouTube, Disqus, Intercom, Drift, Calendly, anything.

01Your controls

Tum khud control kar sakte ho — both inside the product and at browser level.

In the product

Theme: Settings → Appearance → Theme. Or click the sun/moon icon in the nav.
Layout: Settings → Appearance → "Reset layout". Clears ac.layout immediately.
Sign out: Top-right menu → Sign out. Clears ac_session, ac_csrf, ac_workspace, and all ac.* local-storage keys except ac.layout.
Full local wipe: Settings → Privacy → "Forget this device". Clears everything including ac.layout.

In your browser

Block all cookies for our domains — yeh allowed hai. Login won't work, but the marketing site stays fully functional.
Clear cookies anytime — we'll just re-issue the essential ones on your next product login.
Use Firefox / Safari / Brave with strict tracker blocking — nothing of ours will trip those filters because we use no trackers.

02Do Not Track & Global Privacy Control

We honour both signals on our marketing site and in the product:

DNT (DNT: 1 header) — already moot for us since we run no trackers, but explicitly: we never escalate to anything tracker-shaped if your browser sends DNT.
GPC (Sec-GPC: 1 header) — treated as a binding "do not sell or share" signal under CCPA / CPRA, even though we don't sell or share anyway.
ePrivacy "no consent" default — applied by default to all users in the EU/EEA/UK regardless of header.

03Changes to this policy

If we ever add a new cookie (we hope we don't have to), this page is updated before the cookie ships, and the change is logged below. Material additions get an in-product banner for 30 days.

v2.1 · MAY 1, 2026 Added ac_workspace for multi-workspace users. Added DNT/GPC section.
v2.0 · APR 9, 2026 Public launch version. Confirmed 0 cookies on marketing site post-Plausible migration.
v1.0 · JAN 14, 2026 Initial cookie inventory for closed beta.

We use almost none.Aur jo use karte hain, neeche poori list hai.

Banner sirf tab dikhana legally required hai jab non-essential cookies use ho.

The complete inventory.

On this marketing site (anilcyborg.com)

In the product (app.anilcyborg.com)