agentfit · privacy · terms · cookie policy

cookie policy

Last updated: 2026-05-28. Effective version: agentfit_consent_v1.

This page describes what cookies and similar storage mechanisms agentfit uses, why, for how long, and how you can change your consent. It is written to satisfy GDPR Art. 7 + 13 and the ePrivacy Directive Art. 5(3).

1. What cookies and similar technologies are

Cookies are small text files a website stores on your device to remember information between requests. Similar technologies (localStorage, IndexedDB, fingerprinting) work analogously. agentfit uses only first-party HTTP cookies — no localStorage, no fingerprinting, no third-party trackers.

2. Data controller

Stanislav Gumeniuk, sole individual operator. Contact: [email protected]. agentfit is a personal project of the data controller; there is no corporate entity, no employees, no co-controllers.

3. Cookie catalogue

Every cookie we set, with category, purpose, lifetime, and recipient. All cookies are first-party — set by agentfit.dev, sent only to agentfit.dev.

Cookie	Category	Purpose	Lifetime	Recipient
`agentfit_admin_session`	strictly necessary	admin JWT (login session for /admin)	24 hours	agentfit.dev only
`agentfit_refresh`	strictly necessary	API refresh JWT (issued by /api/auth/login, consumed by /api/auth/refresh)	7 days	agentfit.dev only
`_gorilla_csrf`	strictly necessary	CSRF token for admin-panel forms	session	agentfit.dev only
`agentfit_consent_v1`	strictly necessary	records your cookie preferences (the choice itself); without it the banner would re-prompt on every page	30 days	agentfit.dev only
`_pk_id`, `_pk_ses` (Plausible)	analytics (opt-in)	self-hosted Plausible page-view counts (only if analytics consent given AND a Plausible instance is configured)	1 day session / 7 days anonymous ID	plausible.agentfit.dev (same operator)

4. Strictly necessary cookies — why no consent is required

ePrivacy Directive Art. 5(3) exempts "technical storage strictly necessary for the provision of an information society service explicitly requested by the user" from the prior-consent requirement. Admin login, CSRF protection, and the consent cookie itself qualify under this exemption — without them, /admin can't function and the banner would re-prompt every page. We list them in the catalogue above for transparency, but no opt-in is collected.

5. Functional cookies — opt-in

Reserved category for future UI preferences (theme, sort order, dismissed hints). None are set today — the toggle exists so adding any preference cookie in the future doesn't require re-prompting the entire user base. Lawful basis if/when used: GDPR Art. 6(1)(a) — explicit consent.

6. Analytics cookies — opt-in

When the operator configures a Plausible instance and you opt in via the banner or settings page, anonymised page-view counts are recorded. Plausible is a privacy-respecting, GDPR-compliant analytics tool that does NOT use cross-site tracking, does NOT fingerprint, and does NOT share data with third parties. The hosted instance, if any, runs on infrastructure controlled by the same data controller. We explicitly do NOT use Google Analytics, Meta pixels, TikTok pixels, Hotjar, or any third-party behavioural tracker. Lawful basis: GDPR Art. 6(1)(a).

7. Third parties

None. We do not embed third-party widgets (no YouTube embeds, no Twitter cards, no Disqus, no Intercom). The only "third party" in any audit run is the target docs site you submit — but those HTTP requests originate from agentfit's server, not your browser, so the target site receives no cookies of yours.

8. How to withdraw or change consent

Three ways, all equivalent:

Click cookie settings in the footer of any page. Change toggles; click save selection.
From the same page, click withdraw all consent. This sets both functional and analytics flags to off but preserves the original consent timestamp as an audit-evidence trail per GDPR Art. 7(1). The banner does NOT reappear after withdrawal — your decision is recorded as "no" rather than "no choice yet."
Delete the agentfit_consent_v1 cookie in your browser's developer tools. The banner will reappear on next visit.

9. Changes to this policy

If we add a new cookie category or materially change the purpose of an existing one, we bump the consent cookie schema version (current: agentfit_consent_v1). Your previous consent becomes invalid; the banner re-prompts and you can record a fresh decision. The "Last updated" date at the top of this page increments on every edit.

10. Contact for data-protection questions

Email [email protected] with "GDPR" in the subject line. Response within 30 days per GDPR Art. 12(3). agentfit operates without a corporate entity and below the GDPR Art. 37 DPO-appointment threshold; the data controller responds personally.

agentfit · browse · rubric · privacy · terms · cookies · cookie settings · bot