Mind Code AI LTD

Cookie Policy

What your browser stores when you use Mind Code and how to manage it.

Last updated 19 October 2026

Sections

What this policy covers

Mind Code AI LTD uses cookies and browser storage to support sign-in, protect account actions, and remember choices on mindcode.sh, app.mindcode.sh, and related Mind Code web services. This policy explains the purposes and controls. Not every item is used on every page.

A cookie is a small value that a website asks your browser to store and send with later requests. Local storage and session storage keep values in your browser without automatically sending them with every request. This policy covers these technologies as well as cookies.

For how we handle personal data more generally, see our Privacy Policy.

Sign-in and security cookies

These cookies support features you request, such as signing in or connecting a repository. Blocking them can prevent those features from working. Authentication cookies can contain personal data or an identifier linked to your account; they are not inherently anonymous.

The following items are set by Mind Code on the domain providing the feature. Names and secure prefixes can vary between local development, production, and the sign-in method used.

First-party cookies used for authentication and connected services
Cookie	Purpose	Duration
authjs.session-token	Keeps a GitHub-authenticated session signed in. The name may have a secure prefix or numbered parts.	Up to 30 days of inactivity by default; a session can renew.
authjs.csrf-token and authjs.callback-url	Protect sign-in requests and remember the destination after authentication. Secure prefixes may apply.	Browser session unless the authentication flow replaces or clears them.
authjs.state, authjs.pkce.code_verifier, authjs.nonce	Protect OAuth handshakes where the selected provider uses them.	Up to 15 minutes; normally cleared when the flow completes.
passkey-session	Keeps a passkey-authenticated session signed in.	7 days, unless cleared or invalidated earlier.
pending_passkey_session	Connects email verification to passkey registration.	10 minutes.
Provider OAuth state and oauth_org_id	Protect integration setup and associate it with the organisation you selected. State names include github_oauth_state, slack_oauth_state, google_oauth_state, microsoft_oauth_state, notion_oauth_state, and atlassian_oauth_state.	10 minutes; normally cleared on completion.

Choices saved in your browser

These values are stored locally, rather than being cookies sent with every request. They usually remain until you change the preference or clear site data. Your browser may remove them earlier.

cookie_consent records the overall accept or reject choice made in the cookie banner.
mind-theme remembers your light, dark, or system appearance choice.
mind.pricing.currency remembers the currency selected for pricing.
mind.home.* preferences remember the welcome screen, sidebar position, repository choice, and last manually chosen model in the web workspace.
mind.router.settings remembers model routing preferences in this browser.
mind.installPrompt.dismissedAt records when you dismissed the app installation prompt.

Choices stored on one domain or browser are not automatically shared with another. Browser storage is separate from account settings that are saved on our servers.

Diagnostics and optional measurement

Our web application includes Sentry diagnostics where configured. This can collect errors, performance information, and sampled browser interaction replays. The replay configuration masks text and blocks media, but that does not make every diagnostic record anonymous. Error and network context can still contain personal information.

Browser diagnostics may use session storage to group activity. The cookie banner's saved preference is separate from diagnostic configuration; do not assume rejecting cookies disables every error report, performance event, or replay. You can contact us for information about the configuration that applies to your service.

The presence of analytics or marketing categories in the banner does not mean that every page uses advertising or analytics cookies. Storage use depends on the features and providers involved.

Third-party pages and services

Signing in with GitHub, entering Stripe checkout, or authorising a connected service can take you to another provider's website. That provider may set its own cookies for authentication, security, fraud prevention, or preferences. Its notices and controls apply on its website.

Relevant notices include GitHub privacy, Stripe cookies, and Sentry privacy. A provider's own website may use more cookies than the integration embedded in Mind Code.

Managing your choices

Use Accept or Reject in the cookie banner to record your choice for that browser. Merely visiting a page or continuing to browse is not an affirmative cookie choice. The current banner saves an overall choice rather than separate choices for each optional category.

You can inspect, block, or delete cookies and other stored data in your browser's site settings. To reset a saved banner choice, clear the site's stored data and revisit it. Doing this can sign you out and reset preferences. Clearing cookies alone may leave local-storage choices intact.

Account security, billing records, and server-side operational logs are not disabled by a cookie choice. Contact us if you need help understanding browser diagnostics or exercising privacy rights.

Updates and contact

We update this policy when storage technologies or their purposes change. The date at the top identifies this revision.

For questions about cookies or browser storage, email privacy@mindcode.sh.