Cookie Policy

Cookies and local storage are small pieces of data stored in your browser. We use a small number of them to keep you signed in, remember your preferences, and understand how the Service is used. Product analytics that identify a device or account run only with your consent; separately, cookieless aggregate measurement runs on every visit — section 4 sets out which is which. This policy is part of, and should be read with, our Privacy Policy.

These are required for the Service to work and cannot be switched off through the on-site consent control.

• Authentication (Clerk) — session cookies (such as __session and __client_uat) that keep you signed in and secure your session.
• Bot protection (Cloudflare Turnstile) — used by Clerk on our sign-in and sign-up pages to tell real visitors from automated ones. It may set its own cookies in your browser as part of that check.
• Access gate — a rip_hold_stealth cookie, left over from the period before public launch when the site was access-controlled. It holds an access token and no personal data, and grants nothing now that the site is public. If your browser still has one from that period, it expires on its own; clearing your cookies removes it immediately.

These remember your preferences on your own device. They are stored in your browser’s local storage, are not sent to us as tracking, and do not identify you.

• theme — your light/dark appearance preference.
• rh:dashboard-sections — which dashboard sections you have collapsed or expanded.
• rh_consent — your analytics choice itself. We store it here rather than in a cookie, which is why declining analytics leaves no cookie behind at all. Clearing your browser storage resets the choice and you will be asked again.

One further key, rh:admin-secret, is set only on an internal administration page that ordinary accounts cannot reach. It never appears in a normal visitor’s browser.

Analytics help us understand which features are used so we can improve the Service. The two below are treated differently, so we describe each separately rather than together.

• PostHog — product analytics, and the one the consent control governs. It loads only after you accept it; if you decline, it is not loaded and no ph_* cookie is set. When enabled it sets a first-party ph_* cookie and a local-storage entry to hold a device identifier and, once you sign in, to associate feature-usage events with your account. It also records browser errors and page performance. It does not receive the content you write — session recording, automatic click-text capture, surveys, and heatmaps are all switched off — but it does receive your email address and name so we can recognise your account in our analytics tools. Its requests are routed through /ingeston this domain, which forwards them to PostHog’s servers in the United States.
• Vercel Analytics & Speed Insights — aggregate traffic and performance measurement. These are cookieless, store no persistent identifier, and run on every visit regardless of the consent choice, because they measure page volume and load performance rather than individuals.

Two things sit outside the consent control because they are not analytics, and we would rather name them here than have you find them. Neither sets a cookie. First, a few product events — completing a challenge, publishing a thesis — are recorded on our servers when the action happens, as part of operating the Service. Second, if something on a page tries to load from a source our security policy blocks, your browser reports it and we forward a minimal record to Sentry; the Privacy Policy describes exactly what that report contains.

We do not use advertising or cross-site tracking cookies, and we do not sell or share your personal information for cross-context behavioral advertising.

You can accept or decline non-essential analytics using the consent control shown on the site, and you can change your choice at any time. You can also manage or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Service (such as staying signed in) from working.

For more about how we handle personal information, see our Privacy Policy. Questions? Contact us at contact@ripandhold.com.