Overview
A cookie is a small text file stored on your device when you visit a website. OrgMCP only uses cookies that are strictly necessary to deliver the Service you have explicitly asked for (signing in, remembering your active workspace, protecting OAuth callbacks against CSRF). Strictly-necessary cookies are exempt from the consent requirement under the EU ePrivacy Directive and the Estonian Electronic Communications Act; we still list them in full below for transparency.
Strictly necessary cookies
| Name | Purpose | Lifetime |
|---|---|---|
gigamcp_session | Sealed-session cookie issued by WorkOS AuthKit. AES-GCM encrypted with a per-environment secret. Without it you can't sign in. | 30 days |
gigamcp_active_tenant | Stores the identifier of the workspace you most recently selected so you don't have to pick again on every page load. | 365 days |
gigamcp_login_return_to | Remembers the page you were heading to so we can return you there after sign-in. Set just before the login redirect. | 10 minutes |
gigamcp_oauth_authorize_return | Carries the in-flight authorization request when you connect a third-party MCP client (e.g. Claude, ChatGPT, Cursor) and have to sign in first. Cleared once the connection completes. | 15 minutes |
Third-party cookies on /billing
When you open the /billingpage we embed Stripe's Checkout and Customer Portal via the js.stripe.com SDK. Stripe sets its own first-party cookies on the stripe.comdomain to detect fraudulent activity, support the embedded flows, and complete payments. These cookies are governed by Stripe's own cookie notice (stripe.com/cookies-policy/legal); they are essential for the payment functionality and are not used by OrgMCP for analytics or marketing.
Local storage
In addition to cookies, the Service uses a small number of localStorageentries. localStorage is browser-side key/value storage that is not transmitted to our servers; it is listed here for completeness.
| Key | Purpose | Lifetime |
|---|---|---|
gigamcp_cookie_notice_dismissed | Records that you closed the cookie banner so we don't show it on every page load. We deliberately use localStorage rather than a cookie so dismissing the banner does not itself write a tracking artefact. | Until you clear browser storage |
gigamcp_help_widget_open | Remembers whether the in-app help widget is expanded or collapsed. | Until you clear browser storage |
Marketing site
The marketing pages on orgmcp.io currently set no cookies of their own. We also do not load any third-party analytics SDKs (no Google Analytics, no Hotjar, no Segment). If we introduce visitor analytics in the future, this page will be updated and a granular consent banner will appear before any non-essential cookie is set.
How to disable cookies
Because every cookie listed above is strictly necessary, disabling them in your browser will prevent you from signing in to or using the Service. You can still browse the marketing site and read our documentation without cookies enabled.
Changes to this policy
We update this Cookie Policy whenever the underlying cookie or localStorage inventory changes. Material changes are also announced via the cookie banner.
Contact
Questions: privacy@orgmcp.io.
Changelog
- v2.0 — 12 May 2026 — Added a
localStorageinventory (the previous statement that the marketing site set “no cookies at all” was misleading once the cookie banner shipped). Documented Stripe's Checkout cookies on/billing. Referenced the Estonian Electronic Communications Act alongside the EU ePrivacy Directive. Linked to the canonical Privacy Policy from the contact block. - v1.0 — 1 April 2026 — Initial publication.