Cookie Policy
Effective date: April 20, 2026
Plain English, first
Cookies are small files a website stores in your browser. Signroad uses them sparingly — only what is needed to keep you signed in and (if you allow it) a single analytics cookie to help us understand how the app is used. We do not use advertising cookies. We do not let third parties track you across the web.
- Essential cookies are always on, because without them you cannot sign in.
- Analytics cookies are off by default. You can turn them on — and off again — from the banner on first visit, or any time afterwards from Profile → Privacy.
- No advertising cookies. None.
1. What a cookie is
A cookie is a small text file that a website places in your browser. Similar technologies include localStorage, sessionStorage, and browser IndexedDB, all of which we also use. This policy covers all of them together.
2. How we classify cookies
Signroad divides cookies into two categories:
2.1 Essential (strictly necessary)
Always on. These cookies are required to run the service. They are not set for any purpose other than operating the app. Turning them off would break sign-in.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
sb-*-auth-token |
Supabase (first-party) | Keeps your session active so you do not have to re-sign-in on every page load. | 1 hour (access) / 30 days (refresh), rotated |
signroad_session |
Signroad | CSRF protection and basic session correlation. | Session |
signroad_cookie_consent |
Signroad | Remembers your cookie choice so we do not re-prompt you. | 1 year |
2.2 Analytics (opt-in)
Off by default. Only set if you click Allow analytics on the cookie banner, or toggle analytics on from Profile → Privacy. We do not set these in anticipation of consent.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
signroad_analytics_id |
Signroad | A random identifier used to count distinct sessions. Not joinable to your profile or email. | 1 year |
mp_* |
Mixpanel or equivalent | Records which screens you open and which buttons you tap, so we can see which flows help people and which do not. Not joinable to your email. | 1 year |
We aggregate analytics data. We do not build advertising profiles from it. If you turn analytics off, existing analytics cookies are deleted on the next page load.
2.3 What we do not use
- Advertising cookies. None.
- Third-party social tracking pixels. None.
- Cross-site identity graph cookies. None.
- Fingerprinting scripts. None.
3. Your choices
- On the cookie banner that appears the first time you visit Signroad:
- Reject all — only essential cookies are set. Same visual weight and click area as Allow.
- Allow analytics — essential + analytics cookies.
- Manage — toggle each category individually.
- Any time after that: Profile → Privacy → Cookie settings.
- In your browser: browsers let you block or delete cookies per site. Doing this for Signroad may sign you out; doing it from a private/incognito window clears cookies automatically when you close the window.
4. Do Not Track and Global Privacy Control
We honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out from analytics cookies for this browser. We do not treat the legacy Do Not Track (DNT) header as an authoritative opt-out because its meaning is ambiguous, but we also do not ignore it — we treat DNT as a soft signal that reinforces analytics-off defaults.
5. Changes to this policy
If we add a new cookie category (we have no plans to), we update this page and re-prompt users for consent on the next visit.
6. Contact
Questions: privacy@signroad.com.
Attribution
Adapted from Automattic's Legalmattic Cookie Policy template. Original and this adaptation are both licensed under CC-BY-SA 4.0.