Cookie Policy
Last updated 6 September 2026
Rent Ride sets a small number of cookies. Most are necessary for the product to work, and one is for product analytics: measuring which parts of the application are used, so we know what to improve. There is no advertising, no retargeting, and no third-party tracking across other sites. This page lists every cookie we set, every use we make of your browser’s own storage, and what each one is for.
1. What a Cookie Is Here
A cookie is a small file a site asks your browser to keep and send back on the next request. We use them for three purposes: to know that a request belongs to a session that has already signed in, to remember small choices about how the workspace is arranged so it does not reset every time you move between pages, and to count how the product is used. We use your browser’s own local storage in the same spirit, and the storage section below lists that too.
2. Strictly Necessary Cookies
These cannot be turned off without breaking the product. They are set because you asked for a service that cannot be delivered without them, and on that basis they do not require consent.
Authentication Session
Set by our authentication provider when you sign in, and read on every request to establish who you are. Without it there is no way to stay signed in from one page to the next. It is removed when you sign out. The token inside it is short-lived and is refreshed as you use the application; the cookie itself is set to last up to 400 days, so signing out is what ends a session rather than waiting.
rr_active_branch (365 days)
Remembers which branch of your business you are currently looking at, so the workspace does not reset to the first one on every navigation. It holds an identifier and nothing about you.
sidebar_state (7 days)
Remembers whether you left the sidebar expanded or collapsed, so it is drawn the way you left it on the first paint rather than jumping after the page loads. It holds "true" or "false". Unlike the others here it is written by the page itself rather than by our server, so it is readable by scripts in the page; there is nothing in it worth reading.
rr_greeting (12 hours)
The workspace greets you by name in one of a few different ways. This remembers which one was chosen, so the heading does not change every time you open a page. It holds a small number and nothing else.
rr_cf_state and rr_cf_verifier (2 minutes)
Set only if you choose to have us publish your DNS records through Cloudflare, and only for the two minutes that exchange takes. They are the two halves of a security handshake: one proves the response belongs to the request that started it, the other proves the authorisation is being redeemed by whoever asked for it. Both are inaccessible to scripts in the page, and both are deleted as soon as the exchange finishes.
3. Analytics Cookies
One cookie, set by our own origin, that is not strictly necessary. It exists so we can tell which parts of the product are used and which are not, and it is described separately from the section above because that distinction is the honest one.
ph_… (12 months)
Set by PostHog, the product analytics tool we use, and named after the project it belongs to. It holds a random identifier so that several visits from the same browser are counted as one person returning rather than as several people arriving. It does not hold your name, your email address or anything you have typed. Events are sent to our own domain and forwarded from our server, so no analytics company sets a cookie on this site directly.
What is recorded
Which pages are opened, which controls are used, and the ordinary technical facts of a request: a rough location derived from the network address, the browser, and the page that referred you. Once you are signed in, activity is associated with your account identifier so that a customer’s use of the product can be understood as a whole.
Session recordings
A recording of the page is kept as well, so that a step which fails or frustrates can be watched back rather than guessed at. Every piece of text on the page is replaced with asterisks by your own browser before the recording is sent, and the value of every field you fill in is replaced the same way. What reaches us is the shape of the page, where you moved, and what you clicked. Not a name, not a licence number, not an invoice figure, and not anything you typed.
If you would rather not
A browser sending a Do Not Track signal is not counted at all, and we honour that without asking. Beyond that, blocking cookies for this site in your browser settings, or an ordinary content blocker, will stop it; nothing in the product depends on it working.
4. Your Browser’s Own Storage
Four things are kept in your browser’s own storage rather than in a cookie. The first three are read by the page and never sent to us; the fourth belongs to the analytics in section 3 and does travel with the events it describes. Clearing your browser data removes all of it.
Table and page preferences
Which columns you have shown or hidden, how you have sorted a list, and which panels you have opened. Stored against your member id so two people sharing a computer do not inherit each other’s arrangement.
Profile picture cache
The short-lived signed link to your profile picture, kept until it expires so the picture is not re-requested on every page.
Light or dark theme
Which theme you chose, so the correct one is drawn before the page appears rather than flashing the other one first.
Analytics session keys (ph_…)
Kept for the length of a single browsing session, and used to group the events described in section 3 into one visit rather than a series of unrelated ones. Unlike the three above, these are sent with those events. They hold random identifiers and nothing you have entered.
5. What We Do Not Set
Stated explicitly, because the absence is still most of the point. Two things that used to be on this list are not on it any more: product analytics, and the session recording that came with it. Both are described in section 3, and the first entry below is what is left of the second of them.
- No unmasked recording, and no keystroke logging. The recordings described in section 3 have the text of the page masked in your browser before they are sent, so what you can read on screen and what you type into a field are not in them. Nothing here records your keystrokes at all.
- No advertising or retargeting cookies, and no pixels belonging to any advertising network.
- No social media tracking. The links to our social accounts in the footer of an email are ordinary links; they set nothing until you follow them, and what happens then is that network’s business rather than ours.
- No cross-site tracking of any kind, and no sale or sharing of anything for cross-context behavioural advertising. What is measured is how this product is used, and it is not combined with your activity anywhere else.
- No third-party cookies on our own pages. The analytics cookie is set by this domain, and the events behind it are sent to this domain and forwarded by our server.
6. Cookies Set by Others
Two places take you off our infrastructure, and each sets its own cookies under its own policy.
Stripe
Buying a plan and managing a card happen on Stripe’s own hosted pages. Stripe sets cookies there, including for fraud prevention, under its own privacy policy. We do not control them and receive nothing from them.
Signing in with Google takes you to Google, which sets its own cookies under its own policy. We receive back only your name and verified email address.
7. Controlling Cookies
Every browser lets you see, block, and delete cookies and local storage, and most let you do it per site. The analytics cookie in section 3 is the one thing here you can refuse and still use the product fully: block it, send a Do Not Track signal, or run a content blocker, and nothing about the application changes. The rest are necessary, and blocking them will stop you signing in or make the workspace behave as though it has forgotten how you left it.
8. Changes and Questions
An earlier version of this page said that we would ask for your consent before setting any cookie that was not strictly necessary. We have since added the analytics cookie described in section 3 without a consent banner, and this page was updated to say so rather than left standing as written. An earlier version also said that nothing recorded your screen; masked session recording was added afterwards, and section 3 was rewritten to describe it in the same way. Neither sets an advertising cookie, neither follows you anywhere else, and one refusal turns off both. If you would rather either had been put to you first, the address below reaches us and we would like to know. The date at the top is the date of the current version.
Questions about cookies hello@rentride.app
privacy@rentride.app