Cookies Policy
Last updated: 7 September 2026
The short version: this site sets a small number of strictly-necessary cookies to make signing in work. We also offer an optional, first-party aggregate measurement feature. It remains off until you choose "Allow anonymous analytics"; declining is just as easy and does not affect the site.
Fonts are self-hosted, so your browser makes no requests to third-party font or script servers when you visit.
Cookies we set
| Cookie | Purpose | Lifetime |
|---|---|---|
__Secure-authjs.session-token | Keeps you signed in to your dashboard. An encrypted session token, httpOnly and secure — it cannot be read by scripts. | Session (up to 30 days) |
__Host-authjs.csrf-token | Protects sign-in and account forms against cross-site request forgery. | Session |
__Secure-authjs.callback-url | Returns you to the right page after signing in. | Session |
__cf_bm | May be set by Cloudflare, which hosts this site, to distinguish real visitors from malicious bots. | Up to 30 minutes |
rotuli_analytics_consent | Remembers your analytics choice so we can respect it. It holds only granted or denied — not an identifier. | 30 days after your choice |
rotuli_analytics | Only when you opt in: a first-party, HttpOnly 30-day attribution value containing a coarse channel (search, referral, or direct) and a canonical landing-page path. It is used only to increment aggregate daily counts for landings, completed sign-ups, and first API keys. It contains no email, account ID, API key, token, raw referrer, or query string. | 30 days after opt-in |
These cookies are only set when relevant — the sign-in cookies when you create an account or sign in, the Cloudflare cookie as part of serving the site securely, and the two analytics cookies only after an affirmative choice.
Payments and Stripe
When you upgrade to a paid plan, checkout happens on Stripe's own pages (checkout.stripe.com). Stripe sets its own cookies on its own domain there — not on rotuli.co.uk. See Stripe's cookie policy for details.
Controlling cookies
You can block or delete cookies through your browser settings at any time. You can also withdraw analytics consent using the "Privacy settings" button shown on canonical public pages; this immediately removes the analytics attribution cookie and remembers only your declined preference. Blocking the essential sign-in cookies will prevent you from using your account — the public pages work without them.
How the optional measurement works
We store only daily aggregate totals by landing page and coarse channel, not event-level records. Because conversion attribution relies on the same browser retaining the 30-day opt-in cookie, it cannot measure people who decline, clear cookies, use another device to verify email, or arrive without a referrer. It is therefore a consented same-browser cohort, not a total-site conversion rate. Questions? Email privacy@rotuli.co.uk, or see our Privacy Policy.