Cookies
Last updated 10 October 2026
This is a draft. It describes accurately what the software does with data and money. It has not been reviewed by a lawyer, and nothing here should be read as a claim that Kyrovane is compliant with the law of any particular country until that review has happened.
Three cookies, and that is all
| Name | Purpose | Lifetime |
|---|---|---|
| aegis_at | Your access token. Sent with each request so the server knows who you are. | 14 minutes |
| aegis_rt | Your refresh token. Used to get a new access token so you are not signed out every quarter of an hour. | 30 days |
| aegis_theme | The theme you chose: light, dark or the system’s. Written only when you pick one, and it holds nothing but that word. | 1 year |
The two sign-in cookies are httpOnly, so JavaScript in the page cannot read them, which is what stops a script injection from stealing a session; both are SameSite=Lax and marked secure in production. The theme cookie is written by the page itself when you use the theme switch, so it is readable by the page, and it is SameSite=Lax too.
Why there is no cookie banner
The sign-in cookies are strictly necessary, and the theme cookie exists only because you asked for a theme to be remembered. There is no analytics script on this site, no advertising pixel, no session recorder, and no third-party tag of any kind — so there is nothing to ask your consent for, and a banner would be asking permission for something we are not doing.
If we ever add an analytics or marketing cookie, this page will say so before it appears, and it will be off until you agree.
Local storage
The product keeps a little in your browser’s own storage: which workflow editor you last chose (local storage), and, for as long as the tab is open, your recent command-palette searches and which setup steps you have already seen (session storage). None of it is a token or anybody’s personal data, none of it leaves your device, and clearing your browser data removes it.
Turning them off
You can block cookies in your browser. Blocking the two sign-in cookies means you cannot stay signed in, because they are the sign-in; blocking the theme cookie only means the theme follows your system. Clearing them signs you out, which is a perfectly good way to sign out on a shared computer — though ending the session from your security settings is better, since that revokes it on the server rather than just forgetting it here.