Cookie Policy

Roadmark uses a small number of first-party cookies and browser local-storage items. Most are strictly necessary to sign you in and keep the service working, and a few remember what you did in the app — what you've read, hidden or opened recently. The only ones used for measurement are the coarse, non-identifying counters that let a public board's owner see interest. We use no third-party advertising cookies, tracking pixels, or cross-site trackers. This page details each one; the broader picture is in the Privacy Policy.

A cookie is a small text file a site stores in your browser and reads back on later requests. “Local storage” is a related browser feature that keeps a value on your device but — unlike a cookie — is not sent along with every request; it's read only by the page's own code. Both are “first-party” when set by Roadmark itself (as opposed to an embedded third party). Everything below is first-party.

These make the service work — they can't be switched off without breaking sign-in or security features, so they don't require consent. All are HttpOnly and Secure in production (unreadable by page JavaScript, sent only over HTTPS).

• Auth session (sb-…) — set by Supabase Auth to keep you signed in across page loads. Cleared when you sign out. Session-length.
• PKCE code verifier — short-lived, set during password reset and email-change flows to prove the same browser that started the flow is the one that finished it. Deleted as soon as the flow completes.
• pending_email_change_from — short-lived, remembers your previous email during an email change so the “your email was changed” security notice reaches the right address. Cleared once the change settles.
• Share-link unlock grant (rmshare_<board>) — set only when you unlock a password-protected board link. It proves you entered the password so you don't have to re-enter it on every page, is scoped to that one board, and expires with the link (or sooner). No grant cookie is set for ordinary public or private boards.

On public board pages only, Roadmark keeps a few first-party values in your browser's local storage so a board's owner can gauge interest in their roadmap. None of these is a cookie, none holds a name, email, or anything tied to an account, and none is ever sent to a third party.

• rm_visitor_id — a random, non-identifying id used only to tell unique from returning visitors in the owner's view analytics.
• rm_followed_milestones — remembers which milestones you reacted to or asked to be notified about, so the board reflects that back to you on return.
• rm_cookie_notice_dismissed — remembers that you answered the cookie notice, so it isn't shown again.
• rm_view_tracking_optout — records that you chose Decline, so tracking stays off on future visits.

This is an opt-out, not a wall. If your browser signals Do Not Track or Global Privacy Control, or you choose Decline on the notice shown on public boards, we record nothing — only the two opt-out flags above are kept, purely to remember your choice. The board owner's own visits are never counted.

When you're signed in, the app keeps a few small values in your browser so it picks up where you left it. Like the items above they are first-party and never go to a third party, and unlike a cookie they aren't sent to us with each request: only the page's own code reads them. None is used for analytics or advertising. A key that ends in an id carries your account's or a board's, so two accounts on one browser never see each other's.

In local storage, kept until you clear it:

• roadmark:recent-boards:<account> — the last few boards you opened (name and link), listed first in Search before you type.
• roadmark:changelog-seen:<account> — the newest “What's new” entry you've seen, so the dot marks only newer ones.
• roadmark:comments-seen:<board> — the newest comment you've seen on each milestone, so unread counts show at once. The same marker is saved with your account, which keeps it the same on every device.
• roadmark.gettingStartedDismissed:<account> — that you hid the Getting started checklist. The choice is saved with your account too, so it stays hidden on your other devices; this copy hides it here straight away.
• roadmark.promptClosedOn:<account> — the date you last answered or closed the “How's Roadmark working out?” card or the review request, so it doesn't reappear on another page that same day. Only a date; nothing about your answer.

In session storage, which lasts only as long as the tab:

• roadmark.freePlanBannerDismissed — that you closed the Free-plan notice, so it stays closed in this tab.
• roadmark.reviewAckPending — that you just followed the review link on the feedback card, so the card can say thanks when you come back. Removed as soon as it's read.
• roadmark:session-ended-reload — set when your session ends while the page is open (you signed out in another tab, say), so the page reloads once rather than in a loop. Removed on the next load.

Roadmark sets no advertising cookies and embeds no cross-site trackers, ad networks, or social “like” pixels. Traffic across the site is measured with Vercel's cookieless Web Analytics — it sets no cookies and builds no cross-site profile, which is why it isn't in the lists above. When you're signed in we also record how you use the app (the pages, controls and notices, never your content — see the Privacy Policy); that adds no cookie and no storage key either, since it rides on the sign-in you already have, and you can switch it off in your account settings. Checkout for a paid plan is handled by our reseller (see the Refund & Cancellation Policy) on its own pages — any cookies there are governed by that provider's policy, not this one.

• On public boards — use Decline on the cookie notice, or turn on Do Not Track / Global Privacy Control in your browser, to switch off the analytics storage above.
• In your browser — every major browser lets you block or delete cookies and clear local storage from its privacy settings. Blocking the strictly-necessary cookies will sign you out and can break sign-in, password reset, and unlocking protected links.
• Signed in — switch Usage analytics off under Account → Your data, or have your browser send Global Privacy Control, and we record nothing about how you use the app.
• Sign out — clears the auth session cookie for the current browser.

If we add, remove, or change what any cookie or storage item does, we'll update the list above and bump the “Last updated” date. Because none of these is used for advertising or cross-site tracking, we don't expect material changes often.

support@yourroadmark.com