Cookies and browser storage · Effective {{EFFECTIVE_DATE}}
Cookies and browser storage
What the application stores in your browser, and the one place where analytics can load.
Pending legal review — not legal advice. This page describes what the application and the marketing site store in your browser today and was prepared by us; it is being reviewed by a qualified lawyer.
1 · Strictly necessary cookies
These make sign-in and security work. They are set because you asked for the service, so they need no consent under the ePrivacy rules.
| Name | What it is for | Kept |
|---|---|---|
| session | Keeps you signed in. HttpOnly, SameSite=Lax, Secure in production. | 30 days, renewed while in use |
| rf_key | Single-operator installations only: one access key in front of the whole installation. HttpOnly. | 180 days |
| rf_device | A random identifier of this browser, so that a sign-in from a new device can be recognised and reported to you — a security feature of the account. Only a hash of it is stored on our side, and it is used for nothing else. | 400 days |
| rf_oauth | Protects the Google or Microsoft sign-in from forgery for the few minutes it takes. HttpOnly. | Short-lived |
| rf_glink | Holds a pending request to link a Google or Microsoft identity to your account until you confirm it. HttpOnly. | 15 minutes |
| rf_consent | Remembers your choice in the consent banner of the marketing site (analytics: yes or no; ads: yes or no) for rankfinity.app and its sign-in screens, so the banner does not ask again. It holds the choice and its date, nothing else. Set by the marketing site. | 6 months |
| rf_sl_… | Remembers that you entered the password of a shared report link, on this browser only. HttpOnly. | 6 hours |
| rf_shopify_state | Protects the installation of the Shopify app from forgery for the few minutes it takes. HttpOnly. | 10 minutes |
| rf_shopify_link | Holds the one-time token that connects a Shopify store to your Rankfinity account when you open the app from the Shopify admin. HttpOnly. | 30 minutes |
| rf_shopify_pending | A flag that tells the Shopify app which screen to return to after you sign in. Set only while you use the Shopify app. | 30 minutes |
| rf_shopify_acct | Holds the one-time token that connects a Shopify store to an existing Rankfinity account you choose. HttpOnly. | 30 minutes |
| rf_gret | Protects a Google connection started from the Shopify app from forgery, until you return from Google. HttpOnly. | 15 minutes |
2 · Cookies set from a link you followed
| Name | What it is for | Kept |
|---|---|---|
| rf_plan | Remembers which plan you clicked on the marketing site until you sign in. Signed, HttpOnly. It is an intention only — it does not change your plan. | 1 day |
| rf_ref | Remembers the referral code from an invitation link until you sign up, so that the invitation can be credited. Not HttpOnly (it is set by the sign-up page). Set only if you accepted analytics in the consent banner and never when your browser sends Global Privacy Control, and only when you arrive through an invitation link. | 30 days |
| rf_aff | Remembers which partner's link brought you here, so that the partner can be credited if you sign up. Signed, HttpOnly. Set only if you accepted analytics in the consent banner and never when your browser sends Global Privacy Control, and only when you arrive through a partner link. | 60 days by default |
These two cookies are not needed to provide the service you asked for, so they follow the same consent as analytics (section 4). Without consent nothing is stored on your device: if you sign up from the page of the link you followed, the code is sent along with the sign-up request itself and the referral or partner credit still works. An invitation link you opened earlier and then left does not carry over to a later visit.
3 · Browser storage (localStorage)
These stay in your browser, are never sent to us and are not read by anyone else: the theme (rf_theme), the language (rg_lang), table columns and widths (rt_cols_…, rt_colw_…, cw.cols), which menu groups are folded, your last project, the last sign-in method used on this device, and similar screen preferences. They hold no personal data. In the browser tab only (sessionStorage, gone when the tab closes) the app keeps two convenience values: which finished report rows you dismissed (rf_rs_dis) and the next step of a WordPress connection you started (awpNext). They are never sent to us and are not used to recognise you.
4 · Analytics and advertising
Inside the application (after you sign in): none. No analytics or advertising tag loads in the dashboard.
On the sign-in and sign-up screens and on the marketing site we may use Google Analytics 4 and Google Tag Manager to measure visits and sign-ups. They load only if you chose "analytics" in the consent banner of the marketing site (stored in the cookie rf_consent, valid six months) and only if your browser does not send a Global Privacy Control signal. If you gave no consent, or refused, no analytics or tag script is requested from Google. (Fonts and the map library are served from our own domain, so nothing else is requested from Google or a CDN; map screens inside the signed-in application request map tiles from OpenStreetMap, see Privacy section 5.) When they do load, Google sets its own cookies for the rankfinity.app domain:
| Name | Set by | What it is for | Kept |
|---|---|---|---|
| _ga, _ga_… | Google Analytics 4 | Distinguishes visits and sessions so that visits and sign-ups can be counted. Only with analytics consent. | As set by Google (for
_ga, up to two years) |
| Advertising cookies | Google Ads tags loaded by Google Tag Manager | Measures whether an advertisement led to a sign-up. Only with ads consent. | As set by Google |
Withdrawing your consent stops them from loading again; delete the existing ones in your browser settings.
5 · Global Privacy Control
We treat a Global Privacy Control signal from your browser (Sec-GPC: 1 / navigator.globalPrivacyControl) as a refusal of analytics and advertising cookies and as an opt-out of sale or sharing of personal information. We do not sell or share personal information for advertising.
6 · Changing your choice
Use the cookie banner on the marketing site (if shown), or delete the cookie rf_consent in your browser; the next visit asks again. Strictly necessary cookies cannot be switched off, because the service would not work. Questions: {{CONTACT_EMAIL}}. More in the Privacy Policy.
{{COMPANY_LEGAL_NAME}} · {{COMPANY_ADDRESS}} · {{COMPANY_VAT}} ·
{{CONTACT_EMAIL}}
Effective {{EFFECTIVE_DATE}} · Terms · Acceptable use · Privacy · Data Processing · Refunds · Sub-processors · Security · Copyright · Accessibility