Cookie policy disclosure
Copy-paste language for the cookies section of your policy, naming the three cookies arcy.js sets and everything it stores in the browser.
arcy.js sets three first-party cookies on your own domain and stores a handful of keys in localStorage and sessionStorage. None of it serves advertising, none of it follows anyone across sites, and nothing except the consent record is written before the visitor has agreed. One cookie, arcy.cap.<token>, outlives a withdrawal: it is the 24-hour value the chat's daily limit counts against, and it is never linked to a person or an event. How that agreement is asked for, and how your banner and the chat share one answer, is on Consent.
Paste the block below into your own cookie policy, then enter that page's URL as the Cookie policy URL on the Consent card of the Product settings page. Until you do, the ask in the chat links our own cookie policy, which describes the same storage but is our page rather than yours.
Update your policies on ARCY MCP adds these rows to your own cookie table, in its columns and under its statistics group.
This is boilerplate, not legal advice. Have your own counsel review it before publishing.
What to paste
ARCY AI (in-product assistance)
ARCY AI, which powers in-product guidance inside [Your Product Name], sets
three cookies on [yourdomain.com] and stores a small amount of data in your
browser. Apart from the record of your answer, none of it is written until
you have agreed to it. All of it belongs to the statistics category of this
site's cookie settings.
| Name | Purpose | Lifespan |
|------------------------|-------------------------------------------------------------------------|------------|
| arcy.anon.<id> | A random identifier for this browser, so the assistant recognises you | 400 days |
| | on a return visit and your past conversations come back | |
| arcy.consent | Your answer to the question above, when you gave it, and whether you | 400 days, |
| | gave it on this site's cookie banner or inside the assistant. One | 6 months |
| | answer for the whole site, including its subdomains | if you |
| | | declined |
| arcy.cap.<id> | A random value the assistant's daily chat limit counts against, so the | 24 hours |
| | limit cannot be reset by withdrawing and agreeing again. Set when you | after your |
| | send your first message. Never linked to you or to anything you did | last |
| | | message |
It also stores the following in your browser's local storage, which is not
sent to any server:
| Category | Purpose | Lifespan |
|---------------------|-----------------------------------------------------------------------|-----------------------------------|
| Assistant state | Where you moved the assistant, whether you shrank it, and the | Until you clear browser storage |
| | language you chose for it | |
| Appearance | The assistant's colours, so it does not flash unstyled on a reload | Until you clear browser storage |
| Conversation | The current conversation, so it continues if you move between pages | 24 hours after your last message |
| Session | The current session with the assistant | Until you clear browser storage |
| Guided flow | A guided walkthrough in progress, so it survives a page change | Until you clear browser storage |
| Waiting step | What the assistant was doing when a step needed an account, so | 24 hours, with that conversation |
| | signing up carries on from there instead of starting over | |
And the following for the current browser tab only, gone when you close it:
whether this tab is a first visit or a return, which offers the assistant
already made in this tab, a draft walkthrough being previewed, a random
identifier for this tab so a walkthrough in progress continues only in the
tab that started it, and a marker that stops the assistant retrying a
request that has already been refused.
None of this is used for cross-site advertising or third-party tracking. It
is used only to operate the in-product assistant within [Your Product Name].
You can withdraw your agreement at any time from this site's cookie settings,
which deletes everything listed above from your browser except arcy.cap.<id>,
which expires on its own within 24 hours.Technical reference for your CMP or cookie scanner
Every name is prefixed arcy. and suffixed with your environment's Token, for example arcy.anon.<token>, except arcy.consent: it is one per site, so changing or rotating a Token keeps your visitors' answers. This table is for your own configuration, not for a public policy.
| Where | Names |
|---|---|
| Cookies, on your registrable domain | arcy.anon., arcy.consent, arcy.cap. |
localStorage | arcy.shell., arcy.tokens., arcy.chat., arcy.session., arcy.flow., arcy.agent. |
sessionStorage | arcy.visit., arcy.preview., arcy.target., arcy.telemetry.stop., arcy.tab. |
Classify these as statistics storage in your CMP and your policy alike: arcy.js follows your consent tool's statistics category, so your banner and your policy name the same one. If arcy.init() is never called for a visitor, none of it is written. The page measurement arcy.js runs before consent stores nothing in the browser; it is described on What ARCY collects and belongs in your privacy policy rather than here. To let your CMP hear about an Accept given inside the chat, wire arcy.onConsent() as shown on Consent.