Cookie policy
Last updated 2026-10-02
RenewalRedline uses one optional analytics tool, Google Analytics 4, and only if you allow it through the consent bar shown on your first visit. We use no advertising cookies and no cross-site tracking for advertising. Everything else this site stores in your browser is strictly necessary, and this page lists it item by item.
1. What we use, and when we ask
Strictly necessary storage is what the site needs to sign you in or to provide a feature you asked for, such as connecting an app or keeping the API key you typed into the API documentation page. It needs no consent under the ePrivacy rules, so we do not ask for it. Analytics is different: it needs your opt-in. You give or refuse it in the consent bar shown on your first visit, and you can change your choice at any time with Cookie settings in the footer of any public page. Until you allow it, nothing is loaded from Google and no analytics cookie is set.
2. What we actually store, item by item
| Item | Where | Purpose | Cleared |
|---|---|---|---|
| Sign-in tokens (ID token, access token, refresh token) | Browser sessionStorage, not a cookie |
Keeps you signed in while you use the dashboard. The refresh token renews the session without asking you to sign in again, so you are not signed out while you are working | When you close the browser tab, or when you sign out |
| OAuth consent request | Browser sessionStorage (key appcore.oauth.pending.v1), not a cookie |
Only when you connect an AI app to your account. Remembers which app's request you are answering while you sign in, so the consent screen can come back after sign-in | When you allow or decline, after 10 minutes, or when you close the tab |
| Swagger UI authorization | Browser localStorage (key authorized), not a cookie, only on the API documentation page |
Only if you enter an API key in Swagger UI: remembers it so you do not have to paste it again on the API documentation page | Until you log out in Swagger UI or clear site data for renewalredline.com |
| PKCE verifier and state | Browser sessionStorage, not a cookie |
Only when you choose "Continue with Google". Strictly necessary: proves the sign-in redirect came back to the same browser that started it (PKCE, part of the OAuth sign-in flow) | Once sign-in completes, or when you close the tab |
| Cognito sign-in session cookies | Cookies, set by AWS on our Amazon Cognito sign-in domain (a *.amazoncognito.com subdomain), only when you choose "Continue with Google" and the sign-in redirect passes through that domain | Strictly necessary: completes the sign-in redirect | Per Amazon Cognito's own session lifetime |
| Consent choice | Browser localStorage (key appcore.consent.v1), not a cookie |
Remembers whether you allowed analytics, so we do not ask on every page. Strictly necessary | 12 months, then we ask again, or when you clear site data for renewalredline.com |
_ga |
First-party cookie set by Google Analytics on renewalredline.com, only after you allow analytics | Distinguishes visitors, so that the pages read can be counted | 2 years |
_ga_<id> |
First-party cookie set by Google Analytics on renewalredline.com, only after you allow analytics | Keeps the state of a visit | 2 years |
Signing in, creating an account or resetting a password with email and password happens on this site's own pages, which send your details directly to Amazon Cognito over an encrypted connection and set no cookie.
Apart from the Google Analytics cookies you choose to allow, none of the above is used for analytics, profiling, or advertising, and none of it is shared with a third party for those purposes. The Google Analytics cookies are used for analytics only, never for advertising or profiling.
3. Google Analytics
If you allow analytics, we use Google Analytics 4 to understand which pages are read, so we can improve the site. It collects the pages you view, the page that referred you, your approximate location (derived from your IP address, which Google Analytics 4 does not log or store), your device and browser type, and a pseudonymous identifier kept in the _ga cookies.
Google Ireland Limited provides Google Analytics and acts as our processor. Google LLC in the USA may process the data too; see the privacy policy for the safeguards. Google Signals and ad personalisation are turned off, and we do not use this data for advertising.
Google Analytics loads only on the public pages of this site, never on the dashboard or the sign-in pages. Its event data is kept for 14 months and then deleted automatically. Before you allow analytics, your browser does not contact Google for it. Once you do, your browser contacts www.googletagmanager.com and Google Analytics servers (*.google-analytics.com and *.analytics.google.com), which then see your IP address and browser details, as any server does for a file it serves.
4. API documentation page
Our API documentation page at /api/public/docs is built with Swagger UI. It loads Swagger UI's stylesheet and script from cdnjs.cloudflare.com, a public code library service run by Cloudflare. Both files are pinned to one version and checked with Subresource Integrity hashes, so your browser refuses a changed copy. Your browser sends a request to cdnjs when it opens that page, and cdnjs sees your IP address and browser details as it would for any file. cdnjs sets no cookie for us. The only other files this site loads from a third party come from Google, and only if you allow analytics (see Google Analytics above).
If you enter an API key in Swagger UI, it keeps the key in localStorage on this site, as listed in the table above. That storage stays on your device. We do not read it, and it is not sent anywhere but with your own API requests from that page.
5. How you can manage cookies
Choose Cookie settings in the footer of any public page to allow or withdraw analytics at any time. Withdrawing deletes the _ga cookies on this site and stops Google Analytics from loading. If you'd also like to review or clear what your browser holds, every modern browser lets you inspect and delete site data from its settings (often under "Privacy" or "Site settings"). Clearing site data for renewalredline.com also resets your choice, and will sign you out.
6. Changes to this policy
If we ever add another optional feature that needs a non-essential cookie, we will update this page before doing so, not after.
7. Contact
Questions about this policy: hello.invalid [at] renewalredline [dot] com.