Overview
A cookie is a small text file stored on your device when you visit a website. OrgMCP only uses cookies that are strictly necessary to deliver the Service you have explicitly asked for (signing in, remembering your active workspace, protecting OAuth callbacks against CSRF). Strictly-necessary cookies are exempt from the consent requirement under the EU ePrivacy Directive and the Estonian Electronic Communications Act; we still list them in full below for transparency.
Strictly necessary cookies
| Name | Purpose | Lifetime |
|---|---|---|
orgmcp_session | Sealed-session cookie issued by WorkOS AuthKit. AES-GCM encrypted with a per-environment secret. Without it you can't sign in. | 30 days |
orgmcp_active_tenant | Stores the identifier of the workspace you most recently selected so you don't have to pick again on every page load. | 365 days |
orgmcp_login_return_to | Remembers the page you were heading to so we can return you there after sign-in. Set just before the login redirect. | 10 minutes |
orgmcp_oauth_authorize_return | Carries the in-flight authorization request when you connect a third-party MCP client (e.g. Claude, ChatGPT, Cursor) and have to sign in first. Cleared once the connection completes. | 15 minutes |
Third-party cookies on /billing
When you open the /billing page we embed Stripe's Checkout and Customer Portal via the js.stripe.com SDK. Stripe sets its own first-party cookies on the stripe.com domain to detect fraudulent activity, support the embedded flows, and complete payments. These cookies are governed by Stripe's own cookie notice (stripe.com/cookies-policy/legal); they are essential for the payment functionality and are not used by OrgMCP for analytics or marketing.
Local storage
In addition to cookies, the Service uses a small number of localStorageentries. localStorage is browser-side key/value storage that is not transmitted to our servers; it is listed here for completeness.
| Key | Purpose | Lifetime |
|---|---|---|
orgmcp_cookie_notice_dismissed | Records that you closed the cookie banner so we don't show it on every page load. We deliberately use localStorage rather than a cookie so dismissing the banner does not itself write a tracking artefact. | Until you clear browser storage |
orgmcp_help_widget_open | Remembers whether the in-app help widget is expanded or collapsed. | Until you clear browser storage |
orgmcp_ads_consent_v1 | Records your choice on the marketing-site consent banner (accepted or rejected) so we don't ask again. We deliberately use localStorage rather than a cookie so remembering your decision does not itself write a tracking artefact. | Until you clear browser storage |
Google Ads tag & consent
Both the marketing site (orgmcp.io) and the application (app.orgmcp.io) load the Google Ads tag (AW-18467814155) so we can measure which advertising campaigns bring people to OrgMCP and attribute workspace signups. We run it under Google Consent Mode v2: before the tag loads, all advertising and analytics storage signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) are defaulted to denied. No advertising cookie is set, and no conversion is reported, until you press Accept on the consent banner; pressing Reject keeps everything denied. One decision covers both hosts — accepting on the marketing site carries over to the app via the orgmcp_ads_consent cookie below, so you are never asked twice. We do not load any Google Display, Partners, or other remarketing-network scripts, and we set no analytics SDKs such as Hotjar or Segment.
| Name | Purpose | Lifetime |
|---|---|---|
orgmcp_ads_consent | Records your Accept/Reject choice on the consent banner and shares it across orgmcp.io and app.orgmcp.io (scoped to the orgmcp.io parent domain) so you are asked only once. Stores just granted or denied — no identifier. | 6 months |
orgmcp_signup_conversion | A short-lived, one-shot signal set by the server only when you create a new workspace, so the app can report the “OrgMCP Signup” conversion exactly once. Read and cleared on the next page load; never set on a login or a repeat visit. If you have not accepted ads consent, no conversion is reported. | 5 minutes |
How to disable cookies
Because every cookie listed above is strictly necessary, disabling them in your browser will prevent you from signing in to or using the Service. You can still browse the marketing site and read our documentation without cookies enabled.
Changes to this policy
We update this Cookie Policy whenever the underlying cookie or localStorage inventory changes. Material changes are also announced via the cookie banner.
Contact
Questions: privacy@orgmcp.io.
Changelog
- v3.1 — 22 September 2026 — Extended the Google Ads tag (
AW-18467814155) and Consent Mode v2 to the application hostapp.orgmcp.ioso a workspace signup can be attributed, still gated on your consent. Added theorgmcp_ads_consentcookie (shares one consent decision across the marketing site and app) and the short-lived, one-shotorgmcp_signup_conversionsignal cookie (fires the signup conversion once, only on new workspace creation and only with consent). - v3.0 — 22 September 2026 — Documented the Google Ads tag (
AW-18467814155) on the marketing apex, loaded under Google Consent Mode v2 with all advertising/analytics signals defaulted to denied until you accept. Added theorgmcp_ads_consent_v1localStoragekey that records your banner choice. - v2.0 — 12 May 2026 — Added a
localStorageinventory (the previous statement that the marketing site set “no cookies at all” was misleading once the cookie banner shipped). Documented Stripe's Checkout cookies on/billing. Referenced the Estonian Electronic Communications Act alongside the EU ePrivacy Directive. Linked to the canonical Privacy Policy from the contact block. - v1.0 — 1 April 2026 — Initial publication.