Cookie Policy
Last updated: September 7, 2026
1. What this policy covers
This policy explains what RigorDesk stores on your device and why. Although it is called a cookie policy, it covers every kind of local storage we use, including browser local storage. The law that applies here does not care about the technical mechanism: if we put information on your device, or read information already on it, the same consent rules apply. Most of what we store is browser local storage rather than a traditional cookie.
2. What needs your permission
Strictly necessary storage does not need consent, because the site genuinely cannot work without it. Everything else does. We do not load Google Analytics, PostHog or Google One Tap until you have actively opted in, and we treat no answer as a no. Continuing to browse, scrolling, or closing the banner is not consent. Rejecting is a single click and sits next to accepting, at the same size.
Strictly necessary — always on
These are required to sign you in and to honour settings you have chosen. They are first-party only, and none of them are shared with an advertiser.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| sb-<project>-auth-token | Supabase (first party) | Local storage | Keeps you signed in between page loads. Without it you cannot use an account. | Until you sign out or clear site data |
| rigordesk-theme-preference | RigorDesk (first party) | Local storage | Remembers whether you chose the light, dark or system theme. | Until you clear site data |
| rd-cookie-consent | RigorDesk (first party) | Local storage | Records the choice you made on the cookie banner, so we stop asking. | Until you clear site data or the notice changes |
| pendingReferralCode | RigorDesk (first party) | Local storage | Holds a ?ref= code from a shared link so the referral can be credited if you then sign up. Removed as soon as it is claimed. | Until you sign up or clear site data |
Analytics — only with your consent
None of the following load unless you opt in. If you have not answered the banner, or you rejected it, no request is made to any of these providers and none of these entries exist on your device.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| _ga, _ga_<stream id> | Google Analytics 4 | Cookie | Distinguishes one browser from another so we can count visitors and see which pages are used. We run it with advertising features, Google Signals and ad personalisation switched off. | Up to 2 years |
| ph_<project key>_posthog | PostHog | Cookie and local storage | Product analytics: page views, and screen replay on marketing pages only. Replay never runs in the workspace, settings, sign-in or invite pages, and never captures what you type into a field. | Up to 1 year |
| g_state | Google (Sign in with Google) | Cookie | Remembers that you dismissed the Google One Tap sign-in prompt. Loading One Tap also lets Google read its own cookies for your Google account. | Up to 1 year |
3. Changing or withdrawing your choice
You can change your decision at any time using the Cookie settings link in the footer of every page, or the button at the end of this page. Withdrawing consent is as easy as giving it. When you withdraw, we stop analytics immediately in the page you are on and delete the analytics cookies that were already set, rather than waiting for them to expire.
4. Browser-level controls
You can also block or delete storage in your browser settings, and most browsers let you do this per site. Be aware that blocking all storage for rigordesk.com will sign you out and will stop the site remembering your theme, because those depend on the strictly necessary items listed above. We honour the Global Privacy Control signal where your browser sends one, and treat it as a rejection of analytics.
5. Third parties and international transfers
Google Analytics and Google One Tap are provided by Google, and PostHog analytics data is processed on PostHog's United States cloud. If you are in the EEA, the UK or Switzerland, consenting to analytics means your device and usage data may be transferred to the United States. We rely on Standard Contractual Clauses with these providers, alongside the EU-US Data Privacy Framework where the provider is certified under it. You can avoid these transfers entirely by rejecting analytics cookies, which does not restrict your use of the site in any way.
6. What we do not do
We do not use advertising cookies, retargeting pixels, or social media tracking pixels. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under United States state privacy laws. We do not use cookies to build a profile of you across other websites.
7. Manage your choice
Open the cookie banner again to review or change what you allowed. For anything else about your data, see the Privacy Policy.