'Privacy And Consent'

The public site starts from a strict opt-in posture. Essential cookies can run by default. Functional, analytics, and marketing storage require a visitor choice, and Global Privacy Control forces analytics and marketing off.

Public-site cookies

The site uses cookie_consent_v1 to remember consent choices. The cookie is readable by client-side consent code, but it is not an identifier and does not contain an email address, user ID, or agent key.

Cookie and subprocessor tables are generated from source-controlled registries, not from editable marketing copy.

Analytics posture

The live splash can use the same US PostHog project as Console, but only after explicit Analytics consent and only when the deployment kill switch is enabled. Until both conditions are true, the PostHog library is not downloaded and the site creates no PostHog storage.

The splash records six fixed events: a consented route pageview, CTA clicks, story expand/collapse, successful command-copy actions, documentation views, and one visit summary when a visitor navigates away or leaves. It sends route paths without query strings, fixed placement/target and document identifiers, one of three command IDs, authentication state, and deployment environment.

Acquisition origin is reduced to a bounded channel and known source label (for example direct, search/Google, LinkedIn, GitHub, an AI assistant, or an explicitly tagged outreach campaign). Unknown referring sites become other; the raw referrer URL and raw campaign parameters are never sent. An optional campaign link may carry a fixed audience hint such as investor, developer, technical buyer, agent builder, maintainer, security evaluator, or researcher. That hint describes the link, not a conclusion about the person who opened it. Observed behavior is reported separately as low engagement, engaged research, technical evaluation, or signup intent.

Visit summaries include active seconds and elapsed seconds capped at one hour, a coarse duration bucket, maximum scroll-depth bucket, and a behavioral segment: low engagement, engaged researcher, technical evaluator, or signup intent. Active time pauses while the page is hidden and after thirty seconds without activity. The segment is derived only from page behavior such as docs views, command copies, story interaction, and signup actions; it does not claim a visitor's profession, employer, or identity.

The splash never sends command text, graph content, search text, names, email addresses, user credentials, organization IDs, raw referrer URLs, or URL query strings.

Consented visitors begin with PostHog's anonymous identifier. If an existing Console session is present, the analytics wrapper identifies the session using only its opaque user ID. Person profiles are limited to identified visitors. Session replay, autocapture, surveys, exception capture, performance capture, feature flags, dead-click capture, and marketing cookies are disabled.

Withdrawing consent opts the browser out, resets PostHog identity and device state, and removes PostHog cookie, local-storage, and session-storage values while preserving the essential consent choice.

Agent contribution consent

MCP read tools can search public prior art without publishing new knowledge. Write-capable contribution workflows require explicit collection consent because they can publish reusable problem and solution metadata.

GPC behavior

When Global Privacy Control is detected, the site treats it as a do-not-sell/share signal, forces analytics and marketing off, and shows the detected state on the cookie settings page.

Review or change your current browser choice on the cookie settings page.