Cookie Policy
Last updated: 5 October 2026
This page lists every cookie and piece of browser storage RoleCube uses, what each one is for, how long it lasts, and how to change your mind about it.
It is a companion to our Privacy Notice, which covers everything else we do with your data.
1. The short version
- A few strictly necessary cookies keep you signed in, and some browser storage stops you losing unsubmitted work. These cannot be switched off and do not track you.
- Up to three small cookies are set without asking. They hold where you arrived from, a campaign link’s labels (only if the link carried them) and which partner sent you (only if one did), and none is set at all if your browser sends a privacy signal. See section 5.
- Analytics runs only if you agree. Declining costs you nothing, and every feature works the same.
- No advertising at all. No ad tags, no pixels, no remarketing, no cross-site tracking, no data brokers.
- Your attempts, reports and evaluations are stored in our own database, because that is how the product works. They are not analytics, and you cannot switch them off.
- If you agree to analytics, we use PostHog, hosted in the European Union, against a random identifier and never your name or email address.
2. What these technologies are
A cookie is a small file a website asks your browser to store and send back on later visits. Two related technologies do comparable things, and the law treats them the same way:
- Local storage keeps data in your browser until something clears it.
- Session storage works the same way but is discarded when you close the tab.
Everything on this page is first-party: set by RoleCube, on RoleCube’s own domains. Nothing is set by a third party through our site, which is what cross-site tracking relies on.
3. Your choices
Analytics runs only if you agree, and agreeing is never a condition of using RoleCube.
- Change your mind at any time from Profile → Preferences → Privacy when signed in, or “Cookie settings” in the site footer. Withdrawing is as easy as agreeing, and it takes effect straight away, without reloading the page.
- Declining costs you nothing. Every feature works the same either way.
- We never assume consent. Scrolling or browsing is not agreement, nothing is pre-ticked, and until you choose, analytics stays off.
- Once you have an account, your account’s setting applies on every device you sign in from.
- We record your choice: what you chose, when, and which version of this policy you were answering, so we can honour it and show that we did.
- We ask again six months after you answer, and whenever this policy changes in a way that affects what we collect. An answer to an earlier version is treated as no answer until you give a new one.
4. Strictly necessary (no consent required)
The product cannot work without these. They carry no analytics or advertising purpose, which is why the law does not require consent for them.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| __Secure-neon-auth.session_token | First-party cookie | Keeps you signed in across rolecube.com and app.rolecube.com. Signed, encrypted and HTTP-only, so page scripts cannot read it. | 7 days, renewed while you keep using RoleCube, or until you sign out |
| __Secure-neon-auth.local.session_data | First-party cookie | A short-lived, signed copy of your signed-in state, so each page does not have to check with the sign-in service. HTTP-only. | Up to 5 minutes |
| __Secure-neon-auth.session_challenge | First-party cookie | Set briefly while you sign in, to confirm that the sign-in completing is the one you started. HTTP-only. | Only while signing in |
| rc_code_device | First-party cookie | A random identifier, set the first time you enter an access code at sign-up. It lets us make you wait longer after each wrong attempt so codes cannot be guessed. It identifies a browser, not a person, and holds no name, email address or IP address. HTTP-only. Wrong attempts are also counted against your network, by a scrambled form of its address held on our server rather than in any cookie. See section 4.5 of the Privacy Notice. | Up to 13 months |
| rc_signup_pass | First-party cookie | Set when the code you entered is valid. A signed note, tied to the email you entered, that lets the next step create your account. HTTP-only. | 30 minutes |
| rc_consent | First-party cookie | Remembers your answer about analytics (what you chose, when, and against which version of this policy) so we honour it and stop asking. Contains no identifier. | 7 months, or until you change your answer |
| rolecube:report-draft:<scenario>:<attempt> | Local storage | A backup copy of your unsubmitted report on your own device, kept separately for each attempt so it can only ever come back into the attempt it was written for. The report saves to your account as you type; this copy restores changes that did not reach us, for example after a dropped connection. Never read by our servers. | Until you submit the report or sign out, or clear your browser storage |
| rc_onboarding_draft:v1:<email> | Local storage | Keeps a partly completed sign-up so you can pick it up again, including an access code if you entered one. The name contains the email address being registered. | Until sign-up completes, or you clear your browser storage |
| rolecube:mobile-welcome:shown | Session storage | Remembers that the “best on a larger screen” notice has already been shown in this tab. | Until you close the tab |
| rolecube:<scenario>:day-<n>:… | Session storage | Stops in-simulation deadline warnings and meeting reminders repeating within the same tab. | Until you close the tab |
5. Set without asking, but not strictly necessary
We set up to three cookies that are not strictly necessary, and we want to be upfront about them. Only the first is set on an ordinary visit.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| rc_src | First-party cookie | Notes the channel you arrived from as a single word (for example “linkedin”, “google.com” or “direct”) so that if you create an account we can record how you found us. Never a full web address: no page, search terms or other details from the referring site are kept. | 30 days |
| rc_utm | First-party cookie | Set only if the link you arrived through carried campaign labels (the “medium” and “campaign” a marketer adds to a link, for example “email” and “spring-launch”). Remembers them as two short labels so that if you create an account we can record which campaign brought you. No page, search terms or personal detail. An ordinary visit never sets it. | 30 days |
| rc_partner | First-party cookie | Set only if you arrive through a partner’s referral link, one that names the partner. Remembers which partner sent you as a short label (for example “acme”) so that if you create an account we can record who referred you. It holds nothing else: no page, no search terms, no personal detail. An ordinary visit never sets it. | 30 days |
Each holds a short label or two, none is shared with anyone, and none is used to build a profile of you. None is set at all if your browser sends a Global Privacy Control or Do Not Track signal, which means a campaign or partner is simply not credited for that visit. The first value that arrives is kept, so browsing on does not replace it. Clearing your cookies removes them.
6. Measurement: what needs consent and what does not
6.1 Records of the service (no consent required)
When you start an attempt, send a message or receive a reply, open a document, run a query, submit a report, receive an evaluation, or sign up with an access code or have a plan applied to your account, we record it in our own database. The product cannot work otherwise: it is what lets you leave and resume, see your history, and get your results. These records set nothing on your device, and their lawful basis is our contract with you, not consent. They are described in the Privacy Notice.
If you agree to analytics, a stripped-down copy of some of these records is also sent to PostHog so we can see the whole journey in one place: counts, categories and the names of our own scenario content, never anything you wrote. For example, which scenario and attempt it was, which fictional colleague or document was involved, which kind of plan a code gave you, or which campaign or partner brought you, but never the code itself. If you decline, none is sent.
6.2 Analytics (consent required)
Everything else is observation: how you moved through a page or a flow, where you paused, which step lost you, whether you saw that a plan limit had been reached, what kind of device you used and where you arrived from. We collect it only if you agree, using PostHog.
| What | Provider | What it does | Storage it sets |
|---|---|---|---|
| Product analytics | PostHog, hosted in the European Union (Frankfurt) | Records pages viewed and actions taken (for example opening a tab, applying a filter or leaving a step) against a random identifier. Not loaded at all until you agree. | A first-party cookie and matching local storage entry named ph_<project key>_posthog, holding the random identifier and the current visit, kept for one year; and session storage entries for the current tab. Set only after you agree. |
| Masked session replay | PostHog | Reconstructs how a visit moved (scrolling, clicks and which pages were visited) so we can see why people leave a page or miss a button. Every piece of text, every form field and every image is blanked out in your browser before anything is sent, so we see the shape of the page, never what it says or what you type. | None of its own |
| Heatmaps | PostHog | Records where on a page people click, move the pointer and scroll, as positions, never what was typed or read. | None of its own |
7. Advertising: none
RoleCube runs no advertising. There are no ad tags, no remarketing pixels, no ad network conversion trackers, no social media pixels, and no participation in any data-sharing or advertising-identifier scheme.
We do not sell or share personal information for cross-context behavioural advertising, as that phrase is used in the California Consumer Privacy Act or any equivalent law. If this ever changes, we will ask for your consent first and update this page before anything loads.
8. Email
We send only emails you need to use RoleCube: sign-up verification codes, password reset codes, a welcome email when you join, and a short confirmation when you send a problem report. We do not send marketing email.
We do not measure whether our emails are opened or clicked. There are no tracking images and no rewritten links. Our email provider records only whether a message was delivered or bounced, so we can tell when an email you needed did not arrive.
9. Signals we honour
- Global Privacy Control and Do Not Track. If your browser sends either, we treat it as a refusal of analytics: the banner does not ask, nothing is measured, and none of the rc_src, rc_utm or rc_partner cookies is set. We apply this everywhere, not only where the law requires it.
- If you have an account, your own choice there comes first. Turning analytics on yourself in Profile is a more specific instruction than a browser-wide setting, so we follow it. Leaving it off, or turning it off, means nothing is measured.
10. Browser and device controls
Your browser can block or delete storage too. Every major browser offers this under its privacy or site-data settings, along with a private browsing mode that discards everything when you close it.
11. The law behind this
Consent for non-essential storage is required by the ePrivacy Directive (2002/58/EC) in the EEA and by the Privacy and Electronic Communications Regulations in the UK. Those rules cover storing or reading information on your device, whether or not it is personal data, which is why local and session storage are listed here alongside cookies.
Where storage involves personal data, our lawful basis under the UAE Personal Data Protection Law and under the GDPR or UK GDPR is set out in the Privacy Notice: necessity for the service for strictly necessary storage, and your consent for analytics.
12. Changes to this policy
We update this page whenever we add, remove or change a cookie or type of storage. Anything that needs consent you have not already given means asking you again before it runs.
Questions about anything on this page go to privacy@rolecube.com or info@rolecube.com.