Legal information
Cookie policy
Rules for You uses necessary browser storage for secure features and, only with your permission, cookie-free Vercel Web Analytics on public pages.
Updated 2 September 2026 · Version 2
This policy explains how Ed in Park City, LLC, a Utah limited liability company, uses cookies and similar storage technologies on Rules for You. It should be read with the privacy notice.
The current choice
Rules for You uses first-party cookies that are necessary to provide a feature you request or keep the service secure. It does not use advertising, social-tracking, session-replay or personalisation cookies. UK rules do not require opt-in consent for the strictly necessary purposes listed below.
Vercel Web Analytics is optional and does not use analytics cookies. Its script loads only after you choose “Allow anonymous analytics”. Choosing “Use necessary only” leaves it off. The two choices are saved only in local storage on this device, are not attached to your Rules for You account and do not affect access to the service.
What cookies and browser storage we use
| Name or key | Type and purpose | Duration | UK rule used |
|---|---|---|---|
__Host-next-auth.csrf-token and __Secure-next-auth.callback-url | First-party, Secure, HttpOnly, SameSite=Lax cookies used to reject forged authentication requests and return you to the requested Rules for You page. Path: /. Local HTTP development uses the same names without the secure prefixes. | Authentication session or until replaced or deleted. | Strictly necessary security and authentication. |
__Secure-next-auth.pkce.code_verifier, __Secure-next-auth.state and __Secure-next-auth.nonce | First-party, Secure, HttpOnly, SameSite=Lax one-time values used only when you choose Google sign-in. They bind the callback to the browser that started it and validate the Google response. | PKCE and state: up to 15 minutes. Cleared after use; the nonce is otherwise a browser-session cookie. | Strictly necessary security and authentication. |
__Secure-next-auth.session-token | First-party, Secure, HttpOnly, SameSite=Lax cookie. It contains an encrypted session JWT containing the Rules for You user id. It contains no workspace id or role; each protected request reloads membership from the database. Path: /. Local HTTP development uses next-auth.session-token. | Up to 30 days; removed when you sign out. | Strictly necessary account session. |
rfy_pending_invitation | First-party, Secure, HttpOnly, SameSite=Lax cookie containing a one-use invitation token while Google sign-in completes. It does not contain the invited email address or workspace name. | Up to 10 minutes; cleared after successful sign-in. | Strictly necessary for the invitation flow you request. |
rfy_refusal_intake | First-party, Secure, HttpOnly, SameSite=Lax cookie. It contains an opaque claim token that lets a refusal draft submitted before sign-in be attached to the correct workspace after sign-in. It does not contain the refusal text. Path: /. | Up to 24 hours; cleared when claimed or after expiry. | Strictly necessary to provide the temporary draft feature you request. |
rfy_cookie_preferences_v2 | First-party local-storage item, not a cookie. It contains the choice version, whether optional analytics is allowed, the choice time and expiry time. It keeps the privacy controls from reappearing on every page and does not identify you across devices or accounts. | Up to 183 days (about six months), unless you clear site data. | Stores the privacy choice you request. |
The application does not read these cookies with client-side JavaScript. The cookies are sent only to Rules for You over the paths stated in the table. The local-storage item remains in this browser.
Cookie-free Vercel Web Analytics
If you allow it, Vercel Inc.'s Web Analytics service records aggregated page-view data for an approved list of public Rules for You pages. A data point may include the templated page route, time, referrer, approximate location, browser, operating system and device type. Rules for You removes every URL query string, fragment and dynamic record identifier and rejects private, sign-in, account, invitation, confirmation, reset and other token-bearing routes before an event is sent.
Vercel says the service does not use third-party cookies or retain an IP address with the analytics event. It derives a daily visitor hash from the incoming request and discards the visitor-session identifier after 24 hours. Rules for You does not use this service to reconstruct an individual browsing session or for advertising. Read Vercel's Web Analytics privacy information.
When storage is created
- Browsing public pages
- Public research does not need an account cookie. The privacy-choice local-storage item is written only after you choose whether to allow anonymous analytics.
- Starting sign-in
- NextAuth security and return-path cookies are created when you open the sign-in flow. The short-lived PKCE, state and nonce cookies are created only when you choose Google.
- Completing sign-in
- The session cookie is created only after credentials are accepted or a verified Google response passes the required security checks.
- Saving a refusal before sign-in
- The intake cookie is created when you ask Rules for You to save the encrypted temporary draft and continue to a private workspace.
Manage browser storage
Use the control below or the “Cookie settings” button in the footer to reopen the choices. Clearing the local-storage item makes the choices appear again. Your browser controls can block or delete cookies and site data at any time.
Changing to “Use necessary only” prevents further analytics events from being sent. Clearing the preference also leaves analytics off until you make a new choice. You may change your mind at any time.
Blocking necessary cookies does not affect basic public browsing, but it will prevent secure sign-in, keep you from staying signed in and stop a pre-sign-in refusal draft from being claimed. Clearing the session cookie signs you out. Clearing the temporary-draft cookie before claim means the saved draft cannot be linked from that browser.
If another optional technology is added later
Rules for You will not enable a new analytics, advertising or other optional purpose under the current choice. Before any such technology loads, the site must update this policy with the exact provider, purpose and duration, change the choice version, and show equally accessible controls to accept or reject it. Optional purposes must start off, and withdrawal must stop the processing and remove identifiers where technically possible.
Third-party services
Vercel Inc. supplies the optional Web Analytics service described above. Google, Stripe's hosted payment page or an official source opened from Rules for You may use storage on its own domain. That organisation is responsible for explaining its storage. A link or redirect does not allow Rules for You to read another domain's cookies.
Changes and questions
We will update the date and storage table when a name, provider, purpose or duration changes. A material optional-purpose change requires a new choice rather than silent reliance on the old acknowledgement.
- Legal entity
- Ed in Park City, LLC, a limited liability company organised in Utah, United States.
You can also read the privacy notice and terms and conditions.