Cookie Policy

Roadmark uses a small number of first-party cookies and browser local-storageitems. Most are strictly necessary to sign you in and keep the service working; the only non-essential ones are the coarse, non-identifying counters that let a public board's owner see interest. We use no third-party advertising cookies, tracking pixels, or cross-site trackers. This page details each one; the broader picture is in the Privacy Policy.

A cookie is a small text file a site stores in your browser and reads back on later requests. “Local storage” is a related browser feature that keeps a value on your device but — unlike a cookie — is notsent along with every request; it's read only by the page's own code. Both are “first-party” when set by Roadmark itself (as opposed to an embedded third party). Everything below is first-party.

These make the service work — they can't be switched off without breaking sign-in or security features, so they don't require consent. All are HttpOnly and Secure in production (unreadable by page JavaScript, sent only over HTTPS).

• Auth session (sb-…) — set by Supabase Auth to keep you signed in across page loads. Cleared when you sign out. Session-length.
• PKCE code verifier — short-lived, set during password reset and email-change flows to prove the same browser that started the flow is the one that finished it. Deleted as soon as the flow completes.
• pending_email_change_from — short-lived, remembers your previous email during an email change so the “your email was changed” security notice reaches the right address. Cleared once the change settles.
• Share-link unlock grant (rmshare_<board>) — set only when you unlock a password-protected board link. It proves you entered the password so you don't have to re-enter it on every page, is scoped to that one board, and expires with the link (or sooner). No grant cookie is set for ordinary public or private boards.

On public board pages only, Roadmark keeps a few first-party values in your browser's local storageso a board's owner can gauge interest in their roadmap. None of these is a cookie, none holds a name, email, or anything tied to an account, and none is ever sent to a third party.

• rm_visitor_id — a random, non-identifying id used only to tell unique from returning visitors in the owner's view analytics.
• rm_followed_milestones — remembers which milestones you reacted to or asked to be notified about, so the board reflects that back to you on return.
• rm_cookie_notice_dismissed — remembers that you answered the cookie notice, so it isn't shown again.
• rm_view_tracking_optout — records that you chose Decline, so tracking stays off on future visits.

This is an opt-out, not a wall. If your browser signals Do Not Track or Global Privacy Control, or you choose Declineon the notice shown on public boards, we record nothing — only the two opt-out flags above are kept, purely to remember your choice. The board owner's own visits are never counted.

Roadmark sets no advertising cookies and embeds no cross-site trackers, ad networks, or social “like” pixels. Our only site-wide analytics is Vercel's cookieless Web Analytics — it sets no cookiesand builds no cross-site profile, which is why it isn't in the lists above. When paid plans are live, checkout is handled by our reseller (see the Refund & Cancellation Policy) on its own pages — any cookies there are governed by that provider's policy, not this one.

• On public boards — use Decline on the cookie notice, or turn on Do Not Track / Global Privacy Control in your browser, to switch off the analytics storage above.
• In your browser — every major browser lets you block or delete cookies and clear local storage from its privacy settings. Blocking the strictly-necessary cookies will sign you out and can break sign-in, password reset, and unlocking protected links.
• Sign out — clears the auth session cookie for the current browser.

If we add, remove, or change what any cookie or storage item does, we'll update the list above and bump the “Last updated” date. Because none of these is used for advertising or cross-site tracking, we don't expect material changes often.

support@yourroadmark.com