Cookie, Browser Storage & Notification Notice
Effective Date: October 30, 2026 Last Updated: October 30, 2026 Version: cookies-v1
This Notice explains what myai (https://myai.is), operated by Agilefin, LLC, stores in your browser and how our optional device and messaging notifications work. Read this alongside our Privacy Policy at https://myai.is/privacy.
1. Why You Do Not See a Cookie Consent Banner on myai
We do not run advertising trackers, analytics scripts (such as Google Analytics, Mixpanel, Segment, or Hotjar), A/B testing trackers, or social media pixels (such as the Meta Pixel). We do not use localStorage or IndexedDB for tracking, and we never track you across other websites.
Every cookie and browser storage entry myai uses is strictly necessary to deliver a feature you explicitly asked for—such as keeping you signed in, completing a sign-in redirect, keeping your current visitor chat tab open, or remembering the language or theme you selected. Under Article 5(3) of the EU ePrivacy Directive, Regulation 6 of the UK Privacy and Electronic Communications Regulations (PECR), the GDPR, the CCPA/CPRA, and India's DPDP Act, 2023, strictly necessary first-party storage is exempt from pop-up cookie consent banners.
If we ever introduce optional analytics or non-essential cookies in the future, we will ask for your prior opt-in consent before setting them.
2. Strictly Necessary Cookies and Browser Storage We Use
| Name | Type | Set When | Duration / Expiry | Purpose |
|---|---|---|---|---|
myai_session | First-party HTTP-only Cookie (HttpOnly; Secure; SameSite=Lax) | You sign in to your myai account | Session TTL (default 24 hours, or cleared immediately on sign-out / account deletion) | Keeps you authenticated across page loads without exposing your session token to client-side scripts. |
myai_oidc | First-party HTTP-only Cookie (HttpOnly; Secure; SameSite=None, scoped strictly to /api/v1/auth/oidc) | You click "Continue with Google," "Continue with Apple," or "Continue with Microsoft" | 10 minutes (cleared immediately as soon as the sign-in redirect returns) | Seals single-use PKCE and CSRF state/nonce parameters so cross-origin OAuth/OIDC callbacks (including Apple form_post) complete securely. |
myai_lang | First-party Cookie (SameSite=Lax) | You explicitly choose one of our 19 languages in the language picker | 1 year | Remembers the display language you chose. (If you never pick one, we read your browser's Accept-Language header without setting a cookie.) |
myai_theme | First-party HTTP-only Cookie (HttpOnly; Secure; SameSite=Lax) | You explicitly switch from System theme to Light or Dark mode | 1 year (deleted immediately when switched back to System) | Remembers your Light or Dark display preference without using localStorage. |
sessionStorage['myai:<handle>'] | Browser Tab sessionStorage (first-party) | You start a chat as a Visitor on myai.is/<handle> | Current browser tab only (automatically erased by your browser when you close the tab) | Holds the capability token for your active chat with @handle so refreshing the page does not lose your conversation. |
Service Worker (/sw.js & /assets/sw-push.js) | Browser Service Worker | Installed when you use the web app / PWA or enable Web Push notifications | Until unregistered in browser settings | Displays an offline fallback page when you lose connectivity and renders zero-PII push alerts if you turn on notifications. |
Managing Cookies in Your Browser
You can clear or block cookies and sessionStorage at any time in your browser settings. Please note that blocking myai_session or sessionStorage will prevent you from staying signed in or continuing an active visitor chat across page refreshes.
3. Push, Email, and Messaging Notifications
3.1 Browser and Home-Screen (PWA) Push Notifications
-
Strictly Opt-In: Browser and mobile home-screen push notifications (
Web Push) are off by default on every device until you explicitly turn them on in Settings → Notifications (Turn on here) and grant permission in your browser or OS prompt. -
Zero-PII Push Payloads: Because push notifications travel through your browser or operating system vendor's push gateway (Apple Push Notification service, Google Firebase Cloud Messaging, or Mozilla Autopush), myai never puts chat message text, names,
@handles, contact details, or offer amounts inside a push payload. Every push carries only a fixed, localized alert—"You have a new match," "You have a new reply," or "Someone new wants to talk"—and opens a same-origin myai URL when tapped. -
How to Turn Off: Open Settings → Notifications in myai and tap Turn off here (for this device) or Pause all (across all devices and email), or revoke notification permissions for
myai.isin your browser or device OS settings.
3.2 Email Notifications
- If you do not have Web Push active on a device, myai can send a brief transactional email notification to your verified account email when a real person replies or requests an intro (never containing private floor prices or unshared contacts).
- How to Turn Off: Toggle Stop emails or Pause all in Settings → Notifications at any time. (Critical account-security notices—such as one-time sign-in codes or alerts that a passkey was added or removed—are still sent while your account is active.)
3.3 SMS and WhatsApp Codes & Alerts (As Enabled)
- We send SMS or WhatsApp messages only when you explicitly enter your phone number to request a one-time sign-in verification code or explicitly opt in to that channel. We never send marketing or promotional blasts.
-
How to Turn Off: Reply
STOPto any SMS or WhatsApp message from myai, or remove the channel in Settings.
4. Questions
Contact our privacy team at https://myai.is/hq or view our corporate and Grievance Officer details at https://myai.is/legal.