Legal
Cookie Policy
What we store on your device, why, and how to switch off anything that is not strictly necessary.
Last updated: 26 October 2026
In force, some details still being finalised
This describes what we store on your device today. Every cookie listed below was checked against what the site actually sets, and the choice you make here takes effect immediately. Wording is still pending legal review alongside the Privacy Policy.
Region shown: United States (the region you picked).
Location detection is a convenience only. Your actual rights depend on where you live, not on what this page guessed.
1. What this covers
"Cookies" here means cookies and the equivalent storage a browser offers, such as local storage. We use very few, and we list every one of them below rather than describing them in categories and leaving you to guess.
We do not use advertising cookies, we do not run ad networks, and we do not sell or share this data with data brokers.
2. Strictly necessary
These make the site work. They cannot be switched off from here, because without them you could not stay signed in or move between pages.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| sb-<project>-auth-token | Supabase (our authentication provider) | Keeps you signed in. Without it you would be logged out on every page load. | Session, refreshed while you stay active |
| active_location_id | Runday | Remembers which of your locations you are currently looking at, so the calendar and staff pages show the right one. | Persistent until changed or cleared |
| runday_analytics_consent | Runday | Remembers your answer to the analytics question (accepted or declined), so we do not ask on every page and analytics stays off when you said no. It holds that answer and nothing else. | 12 months |
| __cf_bm and similar | Cloudflare | Bot detection and protecting the site from abuse. | Up to 30 minutes |
3. Functional
These remember a small preference. They do not identify you personally.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| runday_site_theme | Runday (browser local storage, not a cookie) | Created only if you choose the site’s look (light or dark) with the header’s button. It holds that choice, “light” or “dark”, so the next pages open in the same look. Nothing else, and it is never sent to our servers. | Persistent until you clear site data |
| runday_app_theme | Runday | Created only when a signed-in person chooses the app’s look (System, Light or Dark) in their settings. It holds that choice, “system”, “light” or “dark”, so the sign-in page opens in the same look on this device. Nothing else; the choice itself is kept in your account. | 1 year, or until another choice |
| runday_display_size | Runday | Created only if you choose a display size (Large, Larger or Largest) with the site header’s button or in the app’s settings. It holds that choice so every page on this device opens at the same size, before it is drawn. Nothing else; choosing Normal deletes it. | 1 year, or until another choice |
| runday_voter_token | Runday (browser local storage, not a cookie) | A random value so the public roadmap can tell one voter from another without asking you to create an account. It is not linked to your name or email. | Persistent until you clear site data |
| runday_voted_ids | Runday (browser local storage, not a cookie) | Which public roadmap ideas this browser has voted for, so their buttons show your vote. It holds the ideas’ ids only. | Persistent until you clear site data |
| runday:mfa-nudge-dismissed | Runday (browser local storage, signed-in pages) | Remembers that you closed the suggestion to turn on two-step verification, so it does not come back on this browser. It holds “1”. | Persistent until you clear site data |
| runday:whats-new:last-seen | Runday (browser local storage, signed-in pages) | The latest “What’s new” entry this browser has shown you, so its dot appears only when there is something new. | Persistent until you clear site data |
| runday:nav-places-seen | Runday (browser local storage, signed-in pages) | Remembers that this browser has seen the one-time note about the menu change, so it is not shown again. It holds “1”. | Persistent until you clear site data |
| runday:time-off-seen | Runday (browser local storage, the team’s app) | When you last opened your time off requests on this device, so the Schedule tab shows a dot when one was answered since. | Persistent until you clear site data |
| runday:setup-collapsed:<shop id> | Runday (browser local storage, the owner’s Today page) | Whether you folded the setup list on this browser. Its name carries your shop’s id; it holds “1”. | Until you unfold the list or clear site data |
| runday:last-page, runday:last-page:portal | Runday (browser session storage, signed-in pages) | The address of the last page you opened in the app, never what you typed in it, so “Report a problem” can say which page it is about. | Until you close the tab |
| runday_ref | Runday | Set only if you follow a referral link from a Runday shop or a Runday partner (rundays.ca/r/…). It holds that link’s code, so that if you open your own shop, we know who sent you, give you 2 extra free weeks, and can thank them (a free month for a shop, a share of Runday’s first month for a partner; your price does not change). It holds nothing about you, and it is erased as soon as your shop is created. | 60 days, or until your shop is created |
| runday_stripe_state | Runday | Set only when a shop owner connects a Stripe account they already have, from their settings. It holds a random code, sealed with a server key so that only the owner and the shop that started the connection can use it when Stripe sends them back. Nothing about them can be read from it, and it is erased on the way back. | 10 minutes, or until Stripe sends them back |
4. Analytics, and your choice
We use Google Analytics to count visits and see which pages people actually use. It is the only non-essential thing we load today, and it is the only category you should have to make a decision about.
Our code can also run PostHog, a product analytics tool for the signed-in application. It is switched off today: no PostHog script loads and nothing from it is stored on your device. Like Google Analytics, it could only ever start after you accept.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| _ga, _ga_<id> | Google Analytics | Counts visitors and shows which pages get used, so we know what to improve. This is the category you can decline. | Up to 2 years |
Analytics does not load until you accept it. Google's script is not placed on the page at all until then. Not loaded in a limited mode, simply absent. If you decline, or if you have not answered yet, no Google cookie is set and no request is made to Google from this site.
If your browser sends a Global Privacy Control signal, we treat that as a refusal without asking you again.
Your current setting
Loading your current setting…
If you turn analytics off, Google's script is gone from the next page you open, and the Google Analytics cookies already on this device (_ga, _ga_<id>) are deleted for this site.
Google Analytics processes data outside Canada. Its own handling is described in Google's privacy policy, and you can opt out across all sites with Google's browser add-on.
5. Controlling cookies yourself
Every major browser lets you see, block, and delete cookies for a site, usually under Privacy settings. Blocking the strictly necessary ones will sign you out and stop parts of Runday working. That is a consequence of blocking them, not a fault.
6. If you are outside Canada
To be written: United States, covering state-level opt-out signals including Global Privacy Control.
7. Questions
Email [email protected]. See also our Privacy Policy and Confidentiality Policy.