AgentSea Space
Cookies and browser storage
Version 08/10/2026 · Not yet in force, awaiting the owner's approval
Draft awaiting the owner's approval. This document is not yet in force and is not legal advice. Wherever it differs from the Privacy notice or the Terms of use, those two documents apply.
This document expands on section 8 of the Privacy notice: what the agentsea.space website and the web app write to your browser, why, how long it stays and how to delete it. It does not cover the desktop app.
This is an English translation. If it differs from the Vietnamese version, the Vietnamese version applies.
Contents6
1. Summary
You press EN at the top of the page, and when you come back the next day the site is still in English. A cookie remembers that for you. The cookies AgentSea sets on agentsea.space only keep your sign-in secure and remember a few of your choices such as language or light and dark mode.
Most of your data lives somewhere else: the company, assistants, tasks and drafts in the web app are stored in the browser on your own computer and are not sent to AgentSea's servers, so another browser or another computer will not show them. AgentSea Space uses no advertising cookies and no third-party analytics.
This summary is for quick reading and does not replace the full text below.
2. Cookies AgentSea sets
The cookies below belong to agentsea.space itself and are only sent back to agentsea.space. Cookies marked "page code cannot read it" are httpOnly: scripts running in the page, including any injected script, cannot get at their contents.
Cookies for signing in and remembering your choices
| Name | What it does | How long |
|---|---|---|
__Secure-authjs.session-token | Keeps you signed in after you enter the code sent to your email or sign in with Google. The contents are encrypted; page code cannot read it. | 7 days, may be renewed while you keep using the site; removed when you sign out |
__Host-authjs.csrf-token | Stops another website from sending a sign-in or sign-out request in your name. Page code cannot read it. | Until you close the browser |
__Secure-authjs.callback-url | Remembers which page to return to once you have signed in. Page code cannot read it. | Until you close the browser |
__Secure-authjs.pkce.code_verifier and related __Secure-authjs.* cookies | Only when you sign in with Google: checks that the reply from Google belongs to the sign-in you just started. Page code cannot read it. | 15 minutes |
agentsea_space_locale | Remembers whether you chose Vietnamese or English. Until this cookie exists, the site picks a language from the country Cloudflare sees for your connection: Vietnamese for Vietnam or an unknown country, English elsewhere. That guess writes nothing to your browser. | 1 year from the last time you switched language |
agentsea_space_theme | Remembers whether you chose light or dark mode. The web app also reads it to open in matching colours when you have not picked colours inside the app. | 1 year from the last time you switched mode |
Third-party cookies and data
Cloudflare sits in front of the whole website to route and protect traffic, as section 6 of the Privacy notice says. On the sign-up page and the waitlist form, the page loads Cloudflare Turnstile from challenges.cloudflare.com to tell people apart from automated traffic. Turnstile runs in Cloudflare's own frame, so whatever it reads or stores in your browser is decided by Cloudflare under Cloudflare's policy; AgentSea only receives a code saying whether the check passed, then asks Cloudflare to confirm that code. When a visit looks unusual, Cloudflare may also set security cookies of its own.
If you choose to sign in with Google, you briefly leave for Google's page; the cookies Google sets there belong to Google's domain and follow Google's policy. The web app page loads neither Turnstile nor any other third-party script, and only allows connections to agentsea.space and the AI providers you chose.
3. Data stored in your browser
Besides cookies, the browser keeps a separate storage area for each website (localStorage and IndexedDB). Unlike cookies, what sits there is not sent along with every page load; the web app reads and writes it right on your computer. As section 2 of the Privacy notice says, AgentSea's servers do not receive this data, so they cannot store or recover it.
| Name | Where | What it holds | Kept until |
|---|---|---|---|
agentsea-space | IndexedDB | The web app's working data: company, assistants, tasks you handed out, drafts, AI calls and the activity log. Each company keeps its newest 500 tasks, plus up to 5,000 AI calls and 5,000 log lines, so the store cannot grow without end. | You delete it |
agentsea-space-cockpit | localStorage | Stand-in for the row above, used only when the browser does not allow IndexedDB, for example in some private windows. | You delete it |
agentsea-space-vault | localStorage | Your AI keys, encrypted with AES-GCM 256 under a key derived from your unlock password (PBKDF2-SHA-256, 600,000 rounds). Written only if you choose to save keys; with Don't store keys, they live only in the open page. | You delete it |
agentsea-space-vault-lock | localStorage | How many times the unlock password was entered wrongly and when you may try again, to stop guessing. | You unlock correctly |
agentsea-space-cockpit-ui | localStorage | How you laid out the web app: light or dark inside the app, whether the activity column is open, the auto-lock time (5, 15 or 60 minutes) and the Stop all state. | You delete it |
agentsea-space-signup-device-v1 | localStorage | A random code created on the sign-up page. The page hashes it with SHA-256 and sends only the hash with your sign-up, as the device hash described in section 4 of the Privacy notice. | You delete it |
The first version of the web app kept AI keys as plain text under agentsea-space-keys, with a short-lived copy named agentsea-space-keys-session. The current web app deletes the short-lived copy as soon as it opens; old-style keys move into the encrypted vault when you set an unlock password, and the plain-text copy is then deleted.
4. No advertising cookies or third-party analytics
As section 8 of the Privacy notice says, AgentSea Space sets no advertising cookies and uses no third-party analytics; the site also carries no social media tracking pixels. If any are needed later, AgentSea will ask for your consent before turning them on and will update this document with a new effective date.
The web app data in your browser is not used for statistics either, because AgentSea's servers do not receive it.
5. How to delete
Press Sign out on the Account settings page to end the sign-in on this browser. Linked devices, AI connections and web app data stay as they are.
In the web app, open Settings and press "Wipe all data from this computer" twice. This deletes the agentsea-space IndexedDB store and every entry whose name starts with agentsea-space in this browser, including saved AI keys and the sign-up page's random code. Deleted data cannot be brought back because AgentSea keeps no copy, so press "Download backup" first; the backup file does not contain AI keys. To remove only the AI keys, use "Delete every saved AI key" under Security.
You can also clear cookies and site data for agentsea.space in your browser's privacy settings. You will be signed out, language and mode go back to their defaults, and the web app data goes with it. If you block cookies altogether, the site still opens, but you cannot sign in and your language and mode choices are not remembered. When the browser blocks storage, the web app still runs for that visit but keeps nothing.
Deleting the sign-up page's random code from your computer does not delete the device hash AgentSea stored when you signed up. That hash is kept as described in section 9 of the Privacy notice; to ask about it or make a request, see section 10.
6. Contact
For questions about cookies or browser storage, or requests about your personal data, message Zalo AgentSea Space. Do not send your unlock password, AI keys or sign-in codes; AgentSea does not need them to answer you.