Mythos Docs

What mythos stores on your device, what each item does, and how to manage it. For how we handle personal data more broadly, see the Privacy Policy.

The short version

The mythos.new app sets only the cookies and browser storage it needs to run: keeping you signed in, protecting sign-in and account-connection flows from forgery, and remembering essential preferences. A project published through Mythos can also set one first-party, host-only 30-minute session cookie when its owner leaves Visitor analytics enabled. We set no advertising cookies, third-party analytics cookies, or marketing tracking pixels.

Every item we store on your device is listed on this page, with its lifetime and what it is for.

Manage cookie preferences

What cookies are

Cookies are small text files a website stores on your device so it can remember things between requests — for example, that you are signed in. Cookies can be first-party (set by the site you are visiting) or third-party (set by another domain whose content is embedded in the page). Similar technologies such as localStorage, sessionStorage, and IndexedDB keep data in your browser without sending it to the server on every request. On this page “cookies” covers all of them, and the tables below list each type separately.

Cookies we set

The mythos.new app cookies in the first table are strictly necessary for sign-in, security, and essential preferences, so they cannot be switched off. The second table is separate: its analytics cookie is set only on a live published site whose owner has Visitor analytics enabled. It is never set in Preview or while a project is unpublished.

Cookies set by the mythos.new app

Storage item	Duration	Purpose
`sb-…-auth-token`	Up to 400 days; refreshed while you use mythos, cleared on sign-out	Keeps you signed in — holds your Supabase Auth session used to authenticate every request. Large sessions may split into numbered chunks (…auth-token.0, .1).
`sb-…-auth-token-code-verifier`	Deleted when sign-in completes; an abandoned sign-in leaves it until its 400-day expiry	Security (PKCE) value proving the browser that finishes sign-in is the same one that started it.
`sb_oauth_state, sb_oauth_pkce`	Legacy only; no longer created, and any existing value expires within 10 minutes	Temporary rolling-deploy compatibility for a Supabase connection started before the server-side OAuth transaction store was enabled.
`mythos_admin_sidebar_v1`	1 year; scoped to the /admin path	Super-admin only. Remembers whether the admin console’s navigation sidebar is collapsed so it renders the same way on your next visit. Set only for accounts with admin access.

Cookie set on analytics-enabled published sites

Storage item	Duration	Purpose
`mythos_analytics_session`	30 minutes after the most recent tracked page view; the lifetime slides on each tracked navigation	Published sites only. A random session UUID groups page views into one anonymous visit when the project owner has Visitor analytics enabled. It is host-only, is not shared across domains, and is not reused as a persistent visitor profile.

mythos.new is served through Cloudflare, our CDN and security provider. Cloudflare may set its own strictly-necessary security cookies (such as __cf_bm) to distinguish humans from automated traffic; those are governed by Cloudflare’s privacy policy.

Browser storage we use

Beyond cookies, mythos uses localStorage for durable recovery and preferences, sessionStorage for tab-scoped recovery, and IndexedDB for attachment bodies that are too large for key-value storage. Names containing angle-bracket placeholders describe a key family rather than a literal key; for example, one owner-scoped key can be created for each account.

A record can reach its stated logical expiry and stop being read before the browser physically deletes its bytes. Where cleanup is best-effort, the duration row says so. You can remove all remaining records at any time by clearing site data for mythos.new.

localStorage keys set by mythos

Storage item	Duration	Purpose
`mythos_cookie_notice_ack_v1`	Until you clear browser storage	Remembers that you dismissed the cookie notice and the choice you made.
`mythos_connectors_workspace_v1`	Until you choose a different workspace, clear the selection, or clear browser storage	Stores only the workspace ID last selected in the Connectors catalogue so the catalogue reopens on that workspace. The saved ID is ignored if the signed-in account can no longer access it.
`mythos_pending_prompt_v3`	Usable for up to 24 hours and cleared immediately after a durable owner-bound handoff claim is confirmed. Expired or invalid copies are ignored and may remain until you clear browser storage	Keeps the project prompt you typed on the landing page so it survives the sign-in redirect.
`mythos:guided-composer:v1`	Removed as soon as you submit or dismiss the draft; an abandoned draft remains until you clear browser storage	Holds the unsubmitted answers of the guided page title, description or favicon form — the project it belongs to, the version of your code it was prepared against, and the wording you chose — so the form survives a reload before you submit it.
`keek_pending_prompt`	Legacy only; no longer read or created. Removed when the current prompt flow next accesses browser storage, or when you clear browser storage	Retired landing-prompt key kept only in cleanup code so a cached pre-owner-binding app version cannot pass its value into the current protocol.
`mythos_post_auth_prompt_handoff_durable_v2`	Usable for up to 15 minutes. The first signed-in account claims it under a browser lock; it is cleared only after exact project-success settlement. Expired or invalid copies are ignored and may remain until you clear browser storage	Paired durable copy of the post-sign-in prompt handoff. It is reconciled with the tab copy so a partial owner claim cannot expose the prompt to another account.
`mythos_post_auth_prompt_handoff_owner`	Usable for up to 15 minutes. Cleared with the exact prompt handoff after project creation or during a later expired-handoff cleanup; otherwise it remains until you clear browser storage	Stores only the signed-in account ID and opaque handoff ID (not the prompt) so an interrupted dashboard navigation can rediscover that account’s owner-bound prompt.
`mythos_post_auth_prompt_handoff_durable`	Legacy only; no longer read or created. Removed when the current prompt flow next accesses browser storage, or when you clear browser storage	Retired durable handoff key retained only for rolling-deploy cleanup. Current handoffs use an isolated versioned key.
`mythos_pending_remix`	A pre-submit choice is usable for up to 15 minutes; a submitted operation for up to 24 hours. Cleared after creation, insufficient-credit settlement, or terminal failure; expired or invalid copies are ignored and may remain until you clear browser storage	Remembers the template remix choice and, after submission, the exact idempotent operation so an interrupted request can be reconciled safely.
`keek_pending_referral`	Cleared after the referral is accepted or definitively rejected. Network errors and explicitly temporary outages keep it for a later sign-in retry; otherwise it remains until you clear browser storage	Stores the referral code from a link you followed so the person who invited you can be credited.
`mythos_pending_blank_project:<account-id>`	Usable for up to 24 hours. Cleared after the project is created or converted into a terminal-failure record; expired or invalid copies are ignored and may remain until exact cleanup or you clear browser storage	One owner-scoped recovery record per signed-in account for an interrupted blank-project creation, including the prompt, template, attachment digest, and idempotency identity.
`mythos_pending_blank_project_failure:<account-id>`	Usable for up to 24 hours. Cleared when the exact failure is dismissed or superseded by a successful retry; expired or invalid owner records are removed during later recovery when browser storage is available	One owner-scoped terminal-failure notice per account so a failed project request can be shown or retried without exposing another account’s draft.
`mythos_pending_blank_project`	Rolling-deploy compatibility only. A saved intent or safety marker is usable for no more than 24 hours; stale copies are ignored and may remain until a later compatibility write or you clear browser storage	Legacy singleton retained temporarily as a fail-closed migration fence while blank-project recovery moves to owner-scoped keys.
`mythos.pending-attachments.v1.<account-id>.<project-id>`	Ready metadata is usable for up to 24 hours. Acknowledgement or expiry replaces it with a small consumed or unavailable marker; terminal project failure deletes it. A marker can otherwise remain until you clear browser storage	Metadata only for an attachment handoff: account and project IDs, timestamps, item count, status, and a payload fingerprint. Attachment bodies are kept separately in IndexedDB.
`mythos:admin-credit-adjust:<account-id>`	No fixed expiry. Cleared after confirmed success or a known terminal rejection; an outcome-unknown operation is kept for exact replay until an administrator reconciles it or clears browser storage	Super-admin only. Preserves an idempotent credit adjustment, including its account, amount, reason, and operation key, across reloads.

sessionStorage keys set by mythos

Storage item	Duration	Purpose
`mythos.share-preview.token.v1`	Until the browser tab is closed or you clear site data; an expired or revoked Share Preview token is rejected by the server	Share Preview only. Keeps the bearer token in the current tab after removing it from the address bar so the shared preview can continue to load.
`mythos.project-presence.session.v1:<project-id>`	Until the browser tab is closed or you clear site data; a new tab receives a different random value	Keeps one random tab-session UUID per open project so presence heartbeats can be retried without creating duplicate sessions. It contains no location, activity history, or last-editor identity.
`mythos.pendingPeopleInvitationToken`	Until the invitation is accepted or the browser tab is closed; removed as soon as it has been used	Holds a workspace invitation token across the sign-in redirect, so opening an invitation link while signed out still joins the right workspace after you sign in.
`mythos_post_auth_prompt_handoff_v2`	Usable for up to 15 minutes. The first signed-in account claims it under a browser lock; it is cleared only after exact project-success settlement or when the tab session ends. Expired or invalid copies are ignored	Tab-scoped half of the owner-bound landing-page prompt handoff. It must agree with the durable copy before the prompt is shown.
`mythos_post_auth_prompt_handoff`	Legacy only; no longer read or created. Removed when the current prompt flow next accesses this tab, or when the tab session ends	Retired tab handoff key retained only for rolling-deploy cleanup. A server protocol fence strips handoff nonces emitted by cached app versions.

IndexedDB storage used by mythos

Storage item	Duration	Purpose
`mythos-local-handoffs / pending_attachments`	Attachment bodies are usable for up to 24 hours and are removed after exact server acknowledgement, terminal project-create failure, expiry cleanup, or when you clear browser storage	IndexedDB database and object store holding attachment bodies and integrity metadata while an interrupted first project creation is safely handed to the server.

Analytics, advertising, and error monitoring

We run no third-party analytics (no Google Analytics, no session recording) and no advertising technology of any kind. Three bounded telemetry paths exist:

Performance and error beacons — anonymous reports (page timing, a JavaScript error) posted to our own endpoints to keep the product fast and working.
Error monitoring (Sentry) — when something breaks, a technical error report is sent through our own domain to Sentry (EU) so we can fix it. The Sentry browser SDK sets no cookies here, session replay is disabled, and reports do not include personal data by default.
Published-site Visitor analytics — only on a live published project whose owner leaves the setting enabled. A first-party script uses the mythos_analytics_session cookie above to group page views into a 30-minute visit. It records only a query-free pathname, referrer hostname or Direct, coarse device class, and country code. It does not retain IP, full user-agent, full referrer, query parameters, a fingerprint, or a cross-visit profile.

Managing cookies

The Manage cookie preferences button above controls the mythos.new app, where the listed categories are informational because those app cookies are strictly necessary. It does not control a different published hostname. Project owners can stop new visitor events immediately under More → Project settings → Publishing → Visitor analytics. Visitors can also block or delete the analytics cookie in their browser; the site owner remains responsible for any notice or consent required by local law.

Your browser also lets you inspect, delete, or block cookies for any site. Clearing mythos.new app cookies signs you out. Clearing a published site’s analytics cookie starts a new anonymous visit if you later return while analytics remains enabled. Cookie settings are per hostname, device, and browser.

Because we do not sell or share personal data for advertising, browsers sending a Global Privacy Control signal are already getting the behaviour it asks for.

Changes and contact

If we add a cookie or storage key, change a lifetime, or introduce a third party that can set cookies, we will update this page and the date shown above.

Questions about our use of cookies: privacy@mythos.new.