Contents
1. Who we are and what this policy covers#
1.1 This policy is provided by Tycoon Agent, a brand of GIXODIA L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates (formation no. 2644769), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
1.2 It covers: (a) our website tycoonagent.ai, including the personal demo and the live store demo at demo.tycoonagent.ai; (b) the optional merchant dashboard at app.tycoonagent.ai; and (c) the Tycoon chat widget on merchants' Shopify stores. How we handle personal information in general is explained in our Privacy Policy.
2. Definitions#
- Cookie: a small text file a website stores in your browser and reads back later.
- Local storage: browser storage that stays until it is deleted or expires.
- Session storage: browser storage that is deleted when you close the tab.
- Storage: in this policy, cookies, local storage, session storage and similar technologies together.
- First party: set by the website you are visiting. Third party: set by another company's domain.
- Strictly necessary: needed for a service you asked for, for security, or to remember a choice you made. It does not need consent.
- GPC (Global Privacy Control): a signal your browser can send to tell websites you do not want your data sold, shared or used for tracking.
3. Our approach#
3.1 We use strictly necessary storage without asking, because the service cannot work without it.
3.2 We use all other storage (functional extras, analytics and marketing) only after you opt in. Until you choose, it stays off.
3.3 Our banner offers Accept all, Reject all and Customize on the first screen, with equal prominence. Boxes are never pre-ticked. You can change your choice at any time through Cookie settings in the website footer.
3.4 Records of your choice. When you make a choice, we store it in your browser under tycoon-consent, and we send a copy to our server so we can prove it. Both contain a random consent ID, your choices, the version of this policy, the time and whether your browser sent GPC. Neither contains your IP address or browser string. The server copy is kept for 24 months.
3.5 Asking again. We ask for your choice again when we change this policy in a way that affects the storage we use. The policy version is part of your saved choice.
4. Our website (tycoonagent.ai)#
| Name | Type | Party | Purpose | Category | Duration |
|---|---|---|---|---|---|
tycoon-consent | Local storage | First | Remembers your cookie choice (consent ID, choices, policy version, language, GPC flag, time). Written only when you make a choice | Strictly necessary | Until you change it, clear your browser, or the policy version changes |
tycoon_gpc | Cookie | First | Notes that your browser sent a GPC signal, so optional storage stays off on every page. Set only when your browser sends GPC | Strictly necessary | 24 hours |
lang | Cookie | First | Remembers the language you chose (English or Hebrew), so you are not redirected again | Strictly necessary (a choice you made) | 1 year |
tycoon-theme | Local storage | First | Remembers the light or dark theme you chose | Strictly necessary (a choice you made) | Until you change it or clear your browser |
tycoon-reduce-motion | Local storage | First | Remembers that you paused animations | Strictly necessary (a choice you made) | Until you change it or clear your browser |
tycoon-chunk-reload | Session storage | First | Lets the page reload once after we publish a new version of the site, so it does not break | Strictly necessary | Until you close the tab |
__cf_bm | Cookie | First (set by Cloudflare for our domain) | Cloudflare's bot protection: tells people from automated traffic. Contains no personal profile | Strictly necessary (security) | 30 minutes |
| Cloudflare Turnstile | Script and challenge frame from challenges.cloudflare.com | Third (Cloudflare) | Checks that the demo form is used by a person. Loads only on the demo form page. Cloudflare uses browser and device signals for this check only, under the Turnstile Privacy Addendum, and may use strictly necessary storage inside its own frame | Strictly necessary (security) | As set by Cloudflare for the check |
Website analytics. We do not currently run any website analytics. If we turn on Cloudflare Web Analytics, which sets no cookies and no storage and measures visits only in aggregate, it will load only after you opt in to analytics and never when your browser sends GPC. We will update this policy before we do.
Lead form. The demo form remembers the first page you opened and the campaign tags in its link only in the page's memory, not in storage, and sends them with the form when you submit it.
We use no advertising, marketing or social media cookies on our website.
Live store demo (demo.tycoonagent.ai). When a store owner opens their personal live demo, we show the store's public pages through our demo service with the Tycoon widget on top. The demo never sends cookies to the store, removes the store's own cookies, pixels and cookie banners, and never opens checkout or customer accounts. It uses:
| Name | Type | Party | Purpose | Category | Duration |
|---|---|---|---|---|---|
__Host-tyd | Cookie | First | Signed demo session that opens your private demo | Strictly necessary | Until the demo link expires, 7 days at most |
__Host-tycart | Cookie | First | The demo cart: product variant IDs and quantities only, no prices and nothing about you | Strictly necessary | Until the demo session ends |
tycoon-demo:id | Local storage | First | Notes which demo this browser last opened, so the widget starts fresh for a different demo | Strictly necessary | Until you clear your browser |
tycoon-demo:bar, tycoon-demo:intro | Session storage | First | Remember that you hid the demo bar or saw the introduction | Strictly necessary (a choice you made) | Until the tab closes |
| Widget storage | Local and session storage | First | The same keys as on a store (Section 6.4), on the demo domain | As in Section 6.4 | As in Section 6.4 |
| Embedded videos | Frames from YouTube or Vimeo | Third | Only if the store's own pages embed a video. The provider may set its own cookies under its own policy | Set by the provider | Set by the provider |
5. The merchant dashboard (app.tycoonagent.ai)#
These cookies are used only on the optional dashboard for merchants who create a direct sign-in. The Tycoon app inside Shopify admin uses Shopify's session tokens and sets no cookies of its own.
| Name | Type | Party | Purpose | Category | Duration |
|---|---|---|---|---|---|
__Host-tycoon_sess | Cookie | First | Keeps you signed in. Our server stores only a hash of it | Strictly necessary | Ends after 12 hours without use, and after 7 days at most |
__Host-tycoon_csrf | Cookie | First | Protects sign-in forms against cross-site request forgery | Strictly necessary (security) | 2 hours |
__Host-tycoon_mfa | Cookie | First | Links your two-factor code to your sign-in attempt | Strictly necessary (security) | 5 minutes |
__Host-tycoon_oauth | Cookie | First | Protects "Continue with Shopify" against forged sign-ins | Strictly necessary (security) | 10 minutes |
tycoon_lang | Cookie | First | Remembers the dashboard language you chose | Strictly necessary (a choice you made) | 1 year |
6. The chat widget on merchants' stores#
6.1 No cookies, only on the store's domain. The widget sets no cookies. It uses local storage and session storage on the store's own domain only, so it cannot follow you to other websites. Every local storage entry has an expiry date, and old Tycoon entries left by earlier versions are deleted the next time a page loads.
6.2 The store's banner decides. The store runs its own consent banner. The widget reads your choices through Shopify's customer privacy tools on every page. Analytics storage is used only if you allowed analytics. Reminder and invitation storage is used only if you allowed marketing. If the store sends no consent signal, or it has not loaded yet, the widget treats it as not allowed. If your browser sends GPC, the widget treats it as a refusal of analytics and marketing storage, whatever the banner says. If you change your choice, the widget follows it without reloading the page.
6.3 Before you open the chat, nothing is stored except tycoon:pv (only when the store owner previews the widget) and tycoon:marked (only if your cart was already tagged with your analytics consent). If you allowed marketing, the invitation and reminder entries below may also be written before you open the chat, because the invitation and reminder appear before it.
6.4 Storage list.
| Key | Type | Purpose | Category | When it is created | Kept |
|---|---|---|---|---|---|
tycoon:pv | Session storage | Signed preview code, used only when the store owner previews the widget | Strictly necessary (store owner only) | Owner preview only | Until the tab closes |
tycoon:sid | Local storage | Random session ID that keeps your conversation going from page to page | Strictly necessary | The first time you open the chat | 30 days, renewed each time you open the chat |
tycoon:tok:<session> | Local storage | Session token proving that this browser owns the conversation | Strictly necessary | When you open the chat | 30 days, renewed each time you open the chat |
tycoon:w | Local storage | Which widget features the store's plan includes. Contains nothing about you | Strictly necessary (configuration) | After you open the chat | 30 days, renewed; deleted with tycoon:sid |
tycoon:ho | Local storage | The store's way to reach a person (for example its WhatsApp or contact page), so the "Talk to a person" button works at once. Contains nothing about you | Strictly necessary | After you open the chat | 30 days, renewed; deleted with tycoon:sid |
tycoon:log | Session storage | The last 30 messages shown in this tab, so the conversation stays visible as you move between pages. "New chat" clears it | Strictly necessary | After you open the chat | Until the tab closes |
tycoon:lang | Session storage | The chat language for this tab | Strictly necessary | When you choose or the chat detects a language | Until the tab closes |
tycoon:attr:<session> | Local storage | An opaque attribution code (not your session ID) that links your chat to a later order, so the store can measure sales the assistant helped with | Analytics (opt-in) | After you open the chat, only with analytics consent | 30 days, renewed; deleted with the session |
tycoon:marked | Session storage | Notes that your cart already carries the attribution code, so it is not added twice | Analytics (opt-in) | After the cart is tagged, only with analytics consent | Until the tab closes |
tycoon:compat | Session storage | Notes that the widget already reported, for this tab, which other chat or sales tools are on the page | Analytics (opt-in) | Only with analytics consent | Until the tab closes |
tycoon:visit | Session storage | Notes that this tab was already counted as a visit, to tell whether you are returning | Marketing (opt-in) | On page load, only with marketing consent | Until the tab closes |
tycoon:teased | Session storage | Notes that the chat invitation was already shown in this tab | Marketing (opt-in) | When the invitation is shown, only with marketing consent | Until the tab closes |
tycoon:rem | Local storage | Time of the last on-site cart reminder, so it appears at most once every 72 hours | Marketing (opt-in) | When a reminder is shown, only with marketing consent. Without it, no reminder is shown | 72 hours |
6.5 Cart attribute and item property. These are saved in your Shopify cart, not in your browser, and stay on the store's order if you buy:
__tycoon_session: the attribution code described above. Added only with analytics consent._tycoon=1: added to an item when the assistant puts it in your cart at your request. It shows that the item was added through the assistant and does not identify you.
6.6 What the widget never does. It does not record keystrokes or mouse movements, does not replay sessions, does not place advertising or social media cookies, and does not send reminders by email, text message or messaging apps.
7. How to change your choices#
7.1 Our website: select Cookie settings in the footer of any page. Withdrawing is as easy as giving consent and takes effect at once.
7.2 A merchant's store: use the store's cookie or privacy settings. You can also turn on GPC in your browser.
7.3 Your browser: you can delete cookies and site data, or block them, in your browser settings. Deleting the store's site data removes the widget's storage. Blocking strictly necessary storage may stop parts of a site or the chat from working.
8. Region-specific information#
8.1 Everywhere. We apply one strict standard: no optional storage without your prior opt-in, refusing as easy as accepting, and GPC honoured. Where a local law is stricter, we follow it.
8.2 European Union and EEA. Storing or reading information on your device needs your prior consent unless it is strictly necessary for a service you asked for (Article 5(3) of the ePrivacy Directive, as implemented in each Member State). Consent meets the GDPR standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
8.3 United Kingdom. We follow the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025. That Act allows some analytics storage without consent, but we still ask for your consent first.
8.4 United States. We do not use storage for targeted advertising, cross-context behavioural advertising or the sale of personal information. We honour GPC as an opt-out preference signal under California law and the laws of other states that recognise it.
8.5 Israel and the UAE. The storage described here is part of the notice we give under section 11 of Israel's Protection of Privacy Law and under the UAE Personal Data Protection Law.
8.6 Merchants' stores. The merchant chooses and runs the store's consent banner and is responsible for making it meet the laws of the places where it sells. The widget follows the choices that banner records (Section 6.2).
9. Changes#
We update this policy when the storage we use changes. The version and dates at the top show the current version, and your saved choice records the version you saw.
10. Contact#
GIXODIA L.L.C-FZ (Tycoon Agent), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. Email: tycoonagent6@gmail.com.
A Hebrew version of this policy is available at tycoonagent.ai/he/cookies. If the versions differ, the English version governs, unless the law that applies to you requires otherwise.
Version history
No earlier versions yet. When a version is replaced, it is kept at /legal/archive/ and linked here.