Cookie Policy
Last updated: June 12, 2026
This policy explains what cookies and similar technologies DeployMill uses on https://deploymill.com (including the dashboard at /account and the docs at /docs), and how you can control them.
The honest summary up front: DeployMill aims to use only strictly-necessary cookies. We're a developer tool with session-based authentication, not an ad-supported product. There are no advertising cookies, no cross-site trackers, and no sale of data derived from cookies. If we ever add optional analytics, this page will say so explicitly and, where the law requires it, we'll ask for your consent first rather than burying it here.
What cookies (and local storage) are
A cookie is a small piece of data a website asks your browser to store and send back on later requests. It's how a server remembers that the request arriving now belongs to the same signed-in person as the request a minute ago. Local storage and session storage are related browser mechanisms for keeping small amounts of data on your device. We group them together with cookies in this policy because the privacy considerations are the same.
Cookies are commonly split into:
- Strictly necessary (essential), required for the site to function at
all: keeping you signed in, protecting forms against cross-site request forgery (CSRF), and completing sign-in flows. These don't require consent under EU law because the service literally doesn't work without them.
- Analytics / preferences / advertising, everything else. **DeployMill
currently uses none of these.**
The cookies we use
DeployMill's authentication is OAuth 2.0 + PKCE via Better Auth, which is session-cookie based. The cookies you'll see fall into these categories:
| Cookie / category | Purpose | Essential? | Duration |
|---|---|---|---|
| Session / authentication (Better Auth session cookies) | Keeps you signed in to the dashboard; identifies your authenticated session on each request | Yes | Session-based, refreshed while active; expires after sign-out or inactivity |
| CSRF protection | Protects forms and state-changing requests against cross-site request forgery | Yes | Session |
| Sign-in flow state (OAuth/PKCE state, nonce, callback state) | Carries the short-lived state needed to complete an OAuth or SSO sign-in securely | Yes | Minutes, deleted once the sign-in flow completes |
| Secret hand-off session | Secures the single-use browser link through which a human enters a secret value (so the value never reaches the AI agent) | Yes | Single use; expires with the link |
| Analytics | None today. If optional analytics are ever added, they will be listed here as a separate, non-essential category, and consent will be requested where required | No, and currently not present | n/a |
Exact cookie names are an implementation detail of the auth library and may change between releases (e.g. names prefixed for Better Auth sessions). The categories and purposes above are the stable, accurate description. We don't use cookies to track you across other websites.
Third-party cookies
DeployMill itself sets only first-party cookies. However, if you sign in via a third-party identity provider (for example "Continue with Google", "Continue with GitHub", or your organization's enterprise SSO), that provider's own pages are involved during the sign-in handshake, and the provider may set its own cookies under its own cookie policy. That happens on their domain, governed by their policy (e.g. Google's or GitHub's), and only if you choose that sign-in method. What the provider receives from us is identity-handshake data only. See Subprocessors for the full picture.
Apps that customers deploy on deploymill.app subdomains may set whatever cookies their developers choose. Those are the customer's apps and the customer's cookies. This policy doesn't cover them.
How to control cookies
- Browser settings. Every major browser lets you view, block, and delete
cookies, per-site or globally. See your browser's help pages (look for "cookies" under privacy settings).
- The honest caveat: because every cookie we set is strictly necessary,
blocking cookies for deploymill.com will break sign-in. You won't be able to use the dashboard, complete OAuth flows, or use the secure secret-entry link. The public docs at
/docsremain readable without cookies. - Signing out ends your session, and the session cookie becomes useless to
anyone who obtains it afterward.
Because we don't use non-essential cookies, there's currently no cookie consent banner to manage. There's nothing optional to consent to. If that changes, a consent mechanism will ship alongside the change.
Do Not Track and Global Privacy Control
Some browsers send "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signals. DeployMill doesn't track you across sites or sell/share personal information in the first place, so there is nothing for these signals to turn off. The behavior they request is already our default. We treat GPC signals as a valid opt-out of sale/sharing where laws like the CPRA require it, which in our case changes nothing because no sale or sharing occurs. See the Privacy Policy for the full picture.
Changes to this policy
If we add, remove, or change cookies in a way that matters (especially adding any non-essential category), we'll update this page and the "Last updated" date, and material changes will be announced like Privacy Policy changes (see Privacy Policy).
Contact
Questions about cookies or this policy: [email protected].