cookie policy
Esta página solo está disponible en inglés. La versión en inglés es la que prevalece.
Last updated: 2026-05-28. Effective version: agentfit_consent_v1.
This page describes what cookies and similar storage mechanisms agentfit uses, why, for how long, and how you can change your consent. It is written to satisfy GDPR Art. 7 + 13 and the ePrivacy Directive Art. 5(3).
1. What cookies and similar technologies are
Cookies are small text files a website stores on your device to remember information between requests. Similar technologies (localStorage, IndexedDB, fingerprinting) work analogously. agentfit uses only first-party HTTP cookies — no localStorage, no fingerprinting, no third-party trackers.
2. Data controller
Stanislav Gumeniuk, sole individual operator. Contact: [email protected]. agentfit is a personal project of the data controller; there is no corporate entity, no employees, no co-controllers.
3. Cookie catalogue
Every cookie we set, with category, purpose, lifetime, and recipient. All cookies are first-party — set by agentfit.dev, sent only to agentfit.dev.
| Cookie | Category | Purpose | Lifetime | Recipient |
|---|---|---|---|---|
agentfit_admin_session |
strictly necessary | admin JWT (login session for /admin) | 24 hours | agentfit.dev only |
agentfit_refresh |
strictly necessary | API refresh JWT (issued by /api/auth/login, consumed by /api/auth/refresh) | 7 days | agentfit.dev only |
_gorilla_csrf |
strictly necessary | CSRF token for admin-panel forms | session | agentfit.dev only |
agentfit_consent_v1 |
strictly necessary | records your cookie preferences (the choice itself); without it the banner would re-prompt on every page | 30 days | agentfit.dev only |
agentfit_lang |
strictly necessary | remembers the interface language you explicitly selected via the language switcher or a ?lang= link (UI customization). Written only on an explicit choice — never inferred silently from your browser's Accept-Language — which is why it qualifies for the ePrivacy Art. 5(3) functionality exemption. No tracking, no profiling. |
180 days | agentfit.dev only |
_pk_id*, _pk_ses* (Plausible) |
analytics (opt-in) | self-hosted Plausible page-view counts (only if analytics consent given AND a Plausible instance is configured) | 1 day session / 7 days anonymous ID | plausible.agentfit.dev (same operator) |
4. Strictly necessary cookies — why no consent is required
ePrivacy Directive Art. 5(3) exempts "technical storage strictly necessary for the provision of an information society service explicitly requested by the user" from the prior-consent requirement. Admin login, CSRF protection, the consent cookie itself, and the language preference (set only when you explicitly pick a language) qualify under this exemption — without them, /admin can't function, the banner would re-prompt every page, and an explicitly chosen UI language couldn't persist. We list them in the catalogue above for transparency, but no opt-in is collected.
5. Functional cookies — opt-in
Reserved category for future UI preferences (theme, sort order, dismissed hints). None are set today — the toggle exists so adding any preference cookie in the future doesn't require re-prompting the entire user base. Lawful basis if/when used: GDPR Art. 6(1)(a) — explicit consent.
6. Analytics cookies — opt-in
When the operator configures a Plausible instance and you opt in via the banner or settings page, anonymised page-view counts are recorded. Plausible is a privacy-respecting, GDPR-compliant analytics tool that does NOT use cross-site tracking, does NOT fingerprint, and does NOT share data with third parties. The hosted instance, if any, runs on infrastructure controlled by the same data controller. We explicitly do NOT use Google Analytics, Meta pixels, TikTok pixels, Hotjar, or any third-party behavioural tracker. Lawful basis: GDPR Art. 6(1)(a).
7. Third parties
None. We do not embed third-party widgets (no YouTube embeds, no Twitter cards, no Disqus, no Intercom). The only "third party" in any audit run is the target docs site you submit — but those HTTP requests originate from agentfit's server, not your browser, so the target site receives no cookies of yours.
8. How to withdraw or change consent
Three ways, all equivalent:
- Click cookie settings in the footer of any page. Change toggles; click save selection.
- From the same page, click withdraw all consent. This sets both functional and analytics flags to off but preserves the original consent timestamp as an audit-evidence trail per GDPR Art. 7(1). The banner does NOT reappear after withdrawal — your decision is recorded as "no" rather than "no choice yet."
- Delete the
agentfit_consent_v1cookie in your browser's developer tools. The banner will reappear on next visit.
9. Changes to this policy
If we add a new cookie category or materially change the purpose
of an existing one, we bump the consent cookie schema version
(current: agentfit_consent_v1). Your previous consent
becomes invalid; the banner re-prompts and you can record a fresh
decision. The "Last updated" date at the top of this page
increments on every edit.
10. Contact for data-protection questions
Email [email protected] with "GDPR" in the subject line. Response within 30 days per GDPR Art. 12(3). agentfit operates without a corporate entity and below the GDPR Art. 37 DPO-appointment threshold; the data controller responds personally.