Cookie Policy

411data.io uses browser storage and similar technologies to operate the connect hub and enrich agent. This page describes what we store locally and why.

What we use

localStorage — agent bearer cache

• Key: 411data.userToken.v1
• Contents: your admin bearer (411_…) or usage key (411k_…), agent_id, wallet address, and related mint metadata
• Purpose: so /connect, /playground, and /enrich_agent can attach your bearer without re-pasting it every visit
• Cleared when you sign out at /connect or clear site data in your browser

localStorage — terms acceptance

• Key: 411data_connect_terms_v1
• Contents: map of agent_id → ISO timestamp when you accepted Terms, Privacy, and Cookie policies at first mint
• Purpose: avoid re-prompting after you have acknowledged legal policies for that agent

localStorage — UI preferences

• Batch row limits, demo session preferences, and similar non-sensitive UI state on specific pages

Cookie — magic link visitor id

• Name: 411data.visitor.v1
• Contents: random UUID assigned on first visit (also used as the durable first-touch join key)
• Purpose: idempotent usage-key redeem if the browser closes before the key is saved locally; ties api_usage_log rows to the landing page and campaign that earned a signup
• Duration: up to one year (SameSite=Lax, site-wide path /) when your browser accepts cookies

Cookie — first-touch attribution snapshot

• Name: 411data.first_touch.v1
• Contents: JSON with the first landing path (pathname plus allowlisted marketing query keys only — utm_*, gclid, and similar ad-click ids; never signup tokens such as ?magic=), external referrer (origin + path only — no query string; same-origin referrers are omitted), and any utm_source / utm_medium / utm_campaign from that first URL. Secret preview paths such as /showcase/{code} and /demo/s/{token} are stored as /showcase/ and /demo/s/ without the token.
• Purpose: first-party marketing attribution so signups and paid calls can be joined back to the page and campaign that brought the visitor; written once per browser when cookies are writable, not used for authentication
• Duration: up to one year (SameSite=Lax, site-wide path /) when your browser accepts cookies
• Server-rendered docs (/about, /developers, /quickstart, /pricing, /cookbook/*, and similar) set the same cookies via Set-Cookie on the first HTML response when the snapshot cookie is absent, so organic search landings are captured before the SPA loads.

Cookies

The core API and SPA do not set first-party authentication cookies for wallet-bound agents. Third-party wallet extensions (MetaMask, Coinbase Wallet, etc.) may set their own cookies when you connect a wallet — see those providers' policies.

Analytics

We do not run third-party advertising or analytics cookies on the connect flow. First-party attribution cookies (411data.visitor.v1, 411data.first_touch.v1) record which landing page and campaign brought a visitor so we can measure signups — they are not shared with ad networks.

First-party engagement beacon

On SPA pages we send a lightweight, first-party-only engagement beacon to our own API (POST /api/v1/n). It records anonymous page views, time on page, maximum scroll depth, and clicks on a small fixed set of conversion links (for example Sign up, Developers, Quick start). Payloads use your existing 411data.visitor.v1 id and a per-tab session id — no email addresses, form values, secret path tokens, non-allowlisted query strings, or full referrer URLs. We honour Global Privacy Control: when your browser sends Sec-GPC: 1, the beacon does not run. There is no cross-site tracking and no data is sent to ad networks or third-party analytics vendors.

Server logs may record IP addresses and request paths for abuse protection (see /about).

Your choices

• Clear site data in your browser to remove cached bearers and preferences
• Use /connect?action=restore to re-paste a bearer you saved elsewhere after clearing storage
• Open legal pages in a new tab without losing connect flow state

Changes

We may update this policy. The current version is always at /cookies.

Contact

Questions: /about