Cookie Policy

1.What cookies are

Cookies are small text files a website stores in your browser so it can remember something between pages or visits — for example that you are signed in. This policy lists every cookie RuleFix sets on rulefix.in and in the dashboard, and how to control them. Similar technologies (such as local storage) are covered in the same way; we don't use any for tracking.

2.What we use, in short

• Only strictly necessary cookies. They keep you signed in, protect sign-in and the GitHub connection against forgery, remember choices you make on purpose, and remember your cookie choice.
• No analytics, advertising or tracking cookies, and no third-party scripts that set them. We don't sell or share browsing data.
• All our cookies are first-party (set by rulefix.in). None are used to follow you across other websites.

3.Categories

• Strictly necessary (always on)

  What it's for

  Keep you signed in, protect sign-in and GitHub connections against forgery, remember choices you make on purpose (like collapsing the sidebar) and remember this cookie choice. The site can't work without them, so they're always on.

  Used today

  Supabase sign-in session, rf_consent, rf_sidebar, rf_gh_state, rf_signup_consent.

• Preferences (off unless you allow)

  What it's for

  Would remember optional settings that make the site more convenient, without you asking each time.

  Used today

  We don't currently set any preference cookies. If we add some, they stay off unless you switch this on.

• Analytics (off unless you allow)

  What it's for

  Would help us understand how the site is used, such as which pages are visited, so we can improve it.

  Used today

  We don't currently use analytics cookies or analytics scripts.

• Marketing (off unless you allow)

  What it's for

  Would measure or personalise advertising on other sites.

  Used today

  We don't currently use marketing or advertising cookies, and we never sell your data.

4.Cookies we set

• sb-<project>-auth-token (may be split into .0, .1 …)

  Category

  Strictly necessary

  Purpose

  Keeps you signed in. Holds your Supabase session (access and refresh tokens). Set only when you sign in.

  Duration

  Up to 400 days, renewed while you use RuleFix; deleted when you sign out

  Scope

  First-party, whole site

• sb-<project>-auth-token-code-verifier

  Category

  Strictly necessary

  Purpose

  Protects the sign-in hand-off with GitHub/GitLab or an email link (PKCE). Set only while you sign in.

  Duration

  Until sign-in completes

  Scope

  First-party

• rf_consent

  Category

  Strictly necessary

  Purpose

  Remembers your cookie choices (version, categories, date, and whether Global Privacy Control was on) so we don't ask on every page.

  Duration

  180 days

  Scope

  First-party, whole site

• rf_sidebar

  Category

  Strictly necessary

  Purpose

  Remembers whether you collapsed the dashboard sidebar. Set only when you click the collapse button.

  Duration

  1 year

  Scope

  First-party, dashboard (/app) only

• rf_gh_state

  Category

  Strictly necessary

  Purpose

  Signed, one-time value that protects the GitHub App installation against cross-site request forgery. httpOnly.

  Duration

  10 minutes

  Scope

  First-party, GitHub callback path only

• rf_signup_consent

  Category

  Strictly necessary

  Purpose

  Proves you accepted the Terms and Privacy Policy before signing up with GitHub or GitLab, so we can record that consent. httpOnly.

  Duration

  10 minutes

  Scope

  First-party, sign-in callback path only

<project> is the identifier of our authentication project. Durations are maximums; most of these cookies are deleted much sooner, for example when you sign out or when a sign-in completes.

Why rf_sidebar is strictly necessary: it is set only when you click to collapse the dashboard sidebar, and does nothing but remember that choice you explicitly asked for. It is never read outside the dashboard.

5.How we record your choice

Your choice is stored in the rf_consent cookie for 180 days: the version of this policy you saw, which optional categories you allowed, the date, and whether your browser sent a Global Privacy Control signal. When it expires, or when we change this policy materially, we ask again.

If you are signed in, we also keep a record of the choice in your account's consent history (visible in Settings → Privacy), so we can show what you agreed to and when. Cookie choices apply to the browser you made them in.

6.Global Privacy Control

If your browser or extension sends a Global Privacy Control (GPC) signal, we treat it as a refusal of all non-essential cookies. The cookie notice will say “GPC respected”. You can still switch categories on yourself in Cookie settings if you want to.

7.Changing your choices

You can change or withdraw your choice at any time — it is as easy as giving it. Open Cookie settings (also linked in the footer of every page) and choose “Reject non-essential”, “Accept all”, or switch individual categories.

You can also delete or block cookies in your browser settings. If you block strictly necessary cookies, you won't be able to sign in.

8.Changes and contact

If we ever want to use a cookie that isn't strictly necessary, we will add it to this page first, keep it off until you allow it, and ask you again. Questions: privacy@rulefix.in. See also our Privacy Policy.