Skip to main content
RateLoopAI Assurance Loop
← Legal

Cookies and browser storage

Last updated: 12 October 2026

RateLoop does not use advertising cookies, cross-site profiling, or audience analytics. The service uses strictly necessary first-party cookies, two functional preference cookies, and limited browser storage to provide authentication, security, review drafts and receipts, the chosen language and appearance, and Chat and integration preferences.

Strictly necessary cookies

  • __Host-rateloop-session (or rateloop-session in local development): a random RateLoop application-session credential. The server stores only its hash. It is HttpOnly, same-site, and expires after up to 12 hours or earlier on logout/revocation.
  • rateloop-identity session and transaction cookies: self-hosted Better Auth cookies used for one-time-code, passkey, SSO, and configured Google or Apple sign-in, including anti-forgery and redirect state. They expire under the authentication transaction or session lifetime and are cleared on logout where applicable.

These cookies are necessary to authenticate the request and protect account mutations. Blocking them prevents sign-in and protected workspace use.

Functional preference cookies

  • rateloop_locale: the display language chosen with the language control. It holds a language code and nothing else, and expires after 365 days.
  • rateloop-theme: the light or dark appearance chosen with the theme control. It holds that choice and nothing else, and expires after 365 days.

Both are written only when a user makes the choice, are read only to render the next page as chosen, and identify nobody. Because each one provides a service the user explicitly asked for, neither requires consent. Clearing them returns the site to the language the browser advertises and to the system appearance.

Local and session storage

  • Review drafts: review drafts use session storage keys beginning rateloop:review-draft:v2: and expire with the assignment or browser session. Draft storage is principal-scoped, bounded, and cleared when ownership changes or the stored expiry passes.
  • Review receipts: after a reviewer submits, session storage keys beginning rateloop:review-receipt:v1: keep the server's acceptance so the confirmation survives a reload. They are scoped to the signed-in account and expire after seven days or with the browser session.
  • Reviewer invitation: when a new reviewer signs in from an invitation link, the local storage key rateloop.reviewer-invitation.pending.v1 carries the invitation code to the sign-in tab. It is removed when read and is not used after 30 minutes.
  • Chat: local storage keys beginning rateloop:chat:v1: remember the conversation last opened in a workspace so Chat can reopen it. They hold only an opaque conversation ID, have no fixed expiry, and can be removed by clearing site data.
  • Integration choice: local storage keys beginning rateloop:agent-host-choice:v1: may remember the agent app selected for a workspace, and keys beginning rateloop:agent-host-setup:v1: that its one-time setup is done. They are convenience preferences and can be removed by changing the choice or clearing site data.
  • Alpha notice: the local storage key rateloop.alpha-notice.dismissed.v1 remembers when a visitor dismisses the testing-environment notice. It contains only the value true, has no fixed expiry, and can be restored by clearing site data.

External media

Attached YouTube media is displayed as a local preview first. RateLoop contacts the youtube-nocookie.com privacy-enhanced player only after the user chooses play. Google may then receive network and device information and may place or read storage under its own policy. Playing the video is optional.

Consent and controls

Because RateLoop does not place non-essential analytics or advertising cookies, it does not show a consent banner for those purposes. If RateLoop later proposes a non-essential browser identifier, it will update this policy and obtain any required consent before activating it. Users can clear RateLoop cookies and site storage in their browser, but doing so signs them out and can permanently remove unsent drafts or local recovery material.

Questions can be sent to hello@rateloop.ai. See the privacy notice for processing purposes, recipients, retention, and rights.

Cookies and browser storage | RateLoop