The short version
The mythos.new app sets only the cookies and browser storage it needs to run: keeping you signed in, protecting sign-in and account-connection flows from forgery, and remembering essential preferences. A project published through Mythos can also set one first-party, host-only 30-minute session cookie when its owner leaves Visitor analytics enabled. We set no advertising cookies, third-party analytics cookies, or marketing tracking pixels.
Every item we store on your device is listed on this page, with its lifetime and what it is for.
Browser storage we use
Beyond cookies, mythos uses localStorage for durable recovery and preferences, sessionStorage for tab-scoped recovery, and IndexedDB for attachment bodies that are too large for key-value storage. Names containing angle-bracket placeholders describe a key family rather than a literal key; for example, one owner-scoped key can be created for each account.
A record can reach its stated logical expiry and stop being read before the browser physically deletes its bytes. Where cleanup is best-effort, the duration row says so. You can remove all remaining records at any time by clearing site data for mythos.new.
localStorage keys set by mythos
| Storage item and duration | Purpose |
|---|---|
mythos_cookie_notice_ack_v1Until you clear browser storage | Remembers that you dismissed the cookie notice and the choice you made. |
mythos_connectors_workspace_v1Until you choose a different workspace, clear the selection, or clear browser storage | Stores only the workspace ID last selected in the Connectors catalogue so the catalogue reopens on that workspace. The saved ID is ignored if the signed-in account can no longer access it. |
mythos-docs-themeUntil you change it or clear browser storage | Remembers whether you chose the light or dark appearance for the documentation. Holds only that choice; with no value stored the documentation follows your operating system. |
mythos_pending_prompt_v3Usable for up to 24 hours and cleared immediately after a durable owner-bound handoff claim is confirmed. Expired or invalid copies are ignored and may remain until you clear browser storage | Keeps the project prompt you typed on the landing page so it survives the sign-in redirect. |
mythos:guided-composer:v1Removed as soon as you submit or dismiss the draft; an abandoned draft remains until you clear browser storage | Holds the unsubmitted answers of the guided page title, description or favicon form — the project it belongs to, the version of your code it was prepared against, and the wording you chose — so the form survives a reload before you submit it. |
keek_pending_promptLegacy only; no longer read or created. Removed when the current prompt flow next accesses browser storage, or when you clear browser storage | Retired landing-prompt key kept only in cleanup code so a cached pre-owner-binding app version cannot pass its value into the current protocol. |
mythos_post_auth_prompt_handoff_durable_v2Usable for up to 15 minutes. The first signed-in account claims it under a browser lock; it is cleared only after exact project-success settlement. Expired or invalid copies are ignored and may remain until you clear browser storage | Paired durable copy of the post-sign-in prompt handoff. It is reconciled with the tab copy so a partial owner claim cannot expose the prompt to another account. |
mythos_post_auth_prompt_handoff_ownerUsable for up to 15 minutes. Cleared with the exact prompt handoff after project creation or during a later expired-handoff cleanup; otherwise it remains until you clear browser storage | Stores only the signed-in account ID and opaque handoff ID (not the prompt) so an interrupted dashboard navigation can rediscover that account’s owner-bound prompt. |
mythos_post_auth_prompt_handoff_durableLegacy only; no longer read or created. Removed when the current prompt flow next accesses browser storage, or when you clear browser storage | Retired durable handoff key retained only for rolling-deploy cleanup. Current handoffs use an isolated versioned key. |
mythos_pending_remixA pre-submit choice is usable for up to 15 minutes; a submitted operation for up to 24 hours. Cleared after creation, insufficient-credit settlement, or terminal failure; expired or invalid copies are ignored and may remain until you clear browser storage | Remembers the template remix choice and, after submission, the exact idempotent operation so an interrupted request can be reconciled safely. |
keek_pending_referralCleared after the referral is accepted or definitively rejected. Network errors and explicitly temporary outages keep it for a later sign-in retry; otherwise it remains until you clear browser storage | Stores the referral code from a link you followed so the person who invited you can be credited. |
mythos_pending_blank_project:<account-id>Usable for up to 24 hours. Cleared after the project is created or converted into a terminal-failure record; expired or invalid copies are ignored and may remain until exact cleanup or you clear browser storage | One owner-scoped recovery record per signed-in account for an interrupted blank-project creation, including the prompt, template, attachment digest, and idempotency identity. |
mythos_pending_blank_project_failure:<account-id>Usable for up to 24 hours. Cleared when the exact failure is dismissed or superseded by a successful retry; expired or invalid owner records are removed during later recovery when browser storage is available | One owner-scoped terminal-failure notice per account so a failed project request can be shown or retried without exposing another account’s draft. |
mythos_pending_blank_projectRolling-deploy compatibility only. A saved intent or safety marker is usable for no more than 24 hours; stale copies are ignored and may remain until a later compatibility write or you clear browser storage | Legacy singleton retained temporarily as a fail-closed migration fence while blank-project recovery moves to owner-scoped keys. |
mythos.pending-attachments.v1.<account-id>.<project-id>Ready metadata is usable for up to 24 hours. Acknowledgement or expiry replaces it with a small consumed or unavailable marker; terminal project failure deletes it. A marker can otherwise remain until you clear browser storage | Metadata only for an attachment handoff: account and project IDs, timestamps, item count, status, and a payload fingerprint. Attachment bodies are kept separately in IndexedDB. |
mythos:admin-credit-adjust:<account-id>No fixed expiry. Cleared after confirmed success or a known terminal rejection; an outcome-unknown operation is kept for exact replay until an administrator reconciles it or clears browser storage | Super-admin only. Preserves an idempotent credit adjustment, including its account, amount, reason, and operation key, across reloads. |
sessionStorage keys set by mythos
| Storage item and duration | Purpose |
|---|---|
mythos.share-preview.token.v1Until the browser tab is closed or you clear site data; an expired or revoked Share Preview token is rejected by the server | Share Preview only. Keeps the bearer token in the current tab after removing it from the address bar so the shared preview can continue to load. |
mythos.project-presence.session.v1:<project-id>Until the browser tab is closed or you clear site data; a new tab receives a different random value | Keeps one random tab-session UUID per open project so presence heartbeats can be retried without creating duplicate sessions. It contains no location, activity history, or last-editor identity. |
mythos-docs-assistantUntil the browser tab is closed, or when you clear the chat | Keeps the questions you asked the documentation assistant, and its answers, so the panel still shows them if you move between documentation pages. It stays in your browser; the questions themselves are sent to the assistant to be answered. |
mythos.pendingPeopleInvitationTokenUntil the invitation is accepted or the browser tab is closed; removed as soon as it has been used | Holds a workspace invitation token across the sign-in redirect, so opening an invitation link while signed out still joins the right workspace after you sign in. |
mythos_post_auth_prompt_handoff_v2Usable for up to 15 minutes. The first signed-in account claims it under a browser lock; it is cleared only after exact project-success settlement or when the tab session ends. Expired or invalid copies are ignored | Tab-scoped half of the owner-bound landing-page prompt handoff. It must agree with the durable copy before the prompt is shown. |
mythos_post_auth_prompt_handoffLegacy only; no longer read or created. Removed when the current prompt flow next accesses this tab, or when the tab session ends | Retired tab handoff key retained only for rolling-deploy cleanup. A server protocol fence strips handoff nonces emitted by cached app versions. |
IndexedDB storage used by mythos
| Storage item and duration | Purpose |
|---|---|
mythos-local-handoffs / pending_attachmentsAttachment bodies are usable for up to 24 hours and are removed after exact server acknowledgement, terminal project-create failure, expiry cleanup, or when you clear browser storage | IndexedDB database and object store holding attachment bodies and integrity metadata while an interrupted first project creation is safely handed to the server. |
Analytics, advertising, and error monitoring
We run no third-party analytics (no Google Analytics, no session recording) and no advertising technology of any kind. Three bounded telemetry paths exist:
- Performance and error beacons — anonymous reports (page timing, a JavaScript error) posted to our own endpoints to keep the product fast and working.
- Error monitoring (Sentry) — when something breaks, a technical error report is sent through our own domain to Sentry (EU) so we can fix it. The Sentry browser SDK sets no cookies here, session replay is disabled, and reports do not include personal data by default.
- Published-site Visitor analytics — only on a live published project whose owner leaves the setting enabled. A first-party script uses the
mythos_analytics_sessioncookie above to group page views into a 30-minute visit. It records only a query-free pathname, referrer hostname or Direct, coarse device class, and country code. It does not retain IP, full user-agent, full referrer, query parameters, a fingerprint, or a cross-visit profile.
Changes and contact
If we add a cookie or storage key, change a lifetime, or introduce a third party that can set cookies, we will update this page and the date shown above.
Questions about our use of cookies: privacy@mythos.new.