Cookies and local storage on runline

What this policy covers

This page explains the cookies and similar storage runline uses on the marketing site and signed-in workspace. Read it with our Privacy Policy and Terms of Service.

Essential cookies

We use essential cookies and local storage to keep you signed in, protect sessions against abuse, remember theme preferences, and store demo/native workspace data on this device. These are required for the product to function and cannot be switched off from the banner.

Analytics & diagnostics

Optional cookies stay rejected by default. If you Accept optional cookies, we may load PostHog (US Cloud) for named product analytics, feature flags, error tracking, and in-product surveys, proxied through /ingest on our domain so the browser talks to runline.space. On Vercel deploys we may also load Vercel Analytics, which counts page views without setting a cookie. Session replay and text autocapture stay off; inputs are masked; we identify by opaque user id and lab id only — never email, name, or protocol content. Global Privacy Control keeps all optional analytics off. The few product events our servers send to PostHog follow the same choice: only when your browser carries the runline_consent cookie set to accepted, never under Global Privacy Control, and never for supervised members. We do not sell personal information, and we do not use advertising trackers for cross-site ads. Rejecting optional cookies disables those scripts.

Referral links

If you open a referral or ambassador link (a URL with ?ref=), we keep the referral code in memory for that visit. Only after you Accept optional cookies do we store it in the runline_ref cookie and in local storage for 90 days so the referral can be credited if you sign up later. If you do not accept, the referral may not be credited. Clearing site data removes it.

Security checks

When CAPTCHA is configured, sign-in, contact, and deletion forms load Cloudflare Turnstile from challenges.cloudflare.com to tell people from bots. It loads only on those forms.

Your choices (no dark patterns)

On your first visit you can Reject optional cookies or Accept optional cookies — both controls have equal visual weight. Essential cookies still run either way. To change your choice later, use Cookie settings in the site footer: it clears your saved choice and shows the banner again. You can also clear site data in your browser at any time; clearing storage will sign you out of local demo sessions and re-show the banner.

Contact

Questions about cookies, retention, or deletion requests go to support@runline.space.

Cookies and storage we set

• sb-<project>-auth-token (and .0/.1 chunks, -code-verifier) · Essential · Session / Supabase refresh window. Supabase sign-in session and PKCE sign-in step.
• protocolos_session · Essential · Until sign-out or expiry. Native workspace session (httpOnly).
• rl_session_hint · Essential · Up to 400 days; cleared on sign-out. Readable flag that you are signed in, so pages render the right chrome. Holds no token.
• runline:account-tier · Essential · 15 minutes; cleared after sign-up. Server-signed, httpOnly. Carries your account type (adult or supervised) and the Terms version you accepted through Google / GitHub sign-up.
• runline:gpc · Essential · 1 year. Records that your browser sent Global Privacy Control so analytics stay off.
• runline_ref · Referral · 90 days. Set when you open a referral or ambassador link (?ref=), so the referral can be credited when you sign up. Also kept in local storage as runline:growth:ref. Written only after you accept optional cookies; before that the code stays in memory for the visit.
• ph_<project>_posthog · Optional analytics · Only after you accept; PostHog default lifetime. PostHog product analytics (cookie and local storage).
• runline:cookie-consent (local storage) · Essential · Until you clear site data. Remembers whether you accepted or rejected optional cookies. Cookie settings in the footer clears it.
• runline_consent · Essential · 1 year; cleared by Cookie settings. Copy of your cookie choice (accepted or rejected) that our servers can read, so server-side analytics follow it too.
• runline:analytics:* (local / session storage) · Analytics helper · Until sent or you clear site data. Funnel bookkeeping (for example a pending sign-up event) so an event is sent once; nothing leaves the device unless analytics are allowed.
• protocolos_* / runline.* (local storage) · Essential · Until you clear site data. Theme, layout, and demo / native workspace data kept on this device.