Privacy

This website

agentcookie.dev sets no cookies. It runs no analytics, no tracking pixels, and no third-party scripts. The fonts are self-hosted with the site rather than loaded from a font service, so rendering a page makes requests to this origin only. There are no forms, no sign-ups, no comments, and nothing that identifies a visitor, so the site stores nothing about you.

The site is hosted on Vercel. Vercel keeps standard request logs for the deployment, which include the requested URL and query string, the response status, and the connection metadata a web server sees. Those request logs are the only server-side data that exists about a visit; the site adds nothing to them and does not export them anywhere. Refer to Vercel's own privacy documentation for how long they retain logs.

The agentcookie tool

The tool moves cookies and secrets only between machines you own and paired yourself, inside your own Tailscale tailnet. There is no hosted relay, no cloud account, and no telemetry: agentcookie never contacts agentcookie.dev or any other server of ours, and the maintainer has no way to see what you sync. Both listeners refuse to bind anything but a tailnet-private address.

Cookie values never appear in agentcookie's logs or in agentcookie doctor output. The pairing-derived keys live in your own configuration directory under ~/.config/agentcookie, and the sink's on-disk copies can be sealed under a key in your own Keychain. Anyone with access to those files has whatever access the files grant; that is the trust boundary, and it is yours.

The threat model describes exactly what agentcookie does and does not protect against, including root on either machine, a compromised Chrome, and device-bound session credentials. Read it before deploying anywhere you care about.