The short version: Ranklet uses two categories of cookies. Strictly necessary cookies are required for the app to work: they keep you signed in and protect form submissions. Analytics cookies are optional and only set if you accept them in the cookie banner. We do not use marketing, advertising, retargeting, social, or cross-site tracking cookies. You can change your choice at any time from the Cookie preferences link in the footer.
1. What cookies are
Cookies are small text files that a website stores in your browser so it can remember something about you between page loads (like the fact that you are signed in) or between visits (like the fact that you previously declined analytics). Some "cookies" referred to in this policy are technically stored in your browser's localStorage rather than as HTTP cookies. They serve the same purpose, so we list them here for transparency even though they are not cookies in the strict technical sense.
We distinguish three things people often lump together:
- First-party cookies / storage set by ranklet.io directly (the session cookie, the consent record).
- Third-party cookies set by a domain other than ranklet.io when you load a Ranklet page. In our case, that's only Google Analytics, only after you consent.
- Other browser storage such as
localStorageorsessionStorage, which under European data-protection guidance is treated the same way as cookies for consent purposes.
Whenever this page says "cookie" without qualification, treat it as covering all three.
2. Categories we use
- Strictly necessary. Required for the app to function: session, CSRF protection, recording your cookie-banner choice. Cannot be turned off; without them you cannot sign in or submit forms safely. Their use does not require consent under GDPR, UK-GDPR, ePrivacy, or PIPEDA.
- Analytics. Help us understand which marketing pages work and which don't. Only set if you grant the Analytics category in the cookie banner. You can withdraw consent at any time.
We do not use the following categories: marketing, advertising, retargeting, social media trackers (Meta, X, LinkedIn, TikTok, Pinterest), session replay or heat-mapping tools, fingerprinting, or any third-party tracker beyond Google Analytics 4.
3. Cookies and storage we set
| Name | Purpose | Category | Retention | Set by |
|---|---|---|---|---|
| _ranklet_session | Holds an encrypted session identifier and your CSRF token. Required for you to stay signed in and to submit forms safely. | Strictly necessary | Session (deleted when you close your browser) | Ranklet (first-party HTTP cookie) |
| ranklet-cookie-consent | Records your cookie-banner choice (accept all / accept only necessary / per-category) so the banner does not re-show every visit. Technically stored in localStorage, not as an HTTP cookie. Listed here for transparency. |
Strictly necessary | Persistent until you clear browser storage or change your choice | Ranklet (first-party localStorage) |
| _ga | Google Analytics 4: distinguishes individual visitors with a pseudonymous identifier. Set only after you grant the Analytics category in the cookie banner. | Analytics | 2 years (we configure to 13 months in Google Analytics for retention; the cookie itself follows GA defaults) | Google (third-party, via our GA4 property) |
| _ga_<ID> | Google Analytics 4: per-property session state for our GA4 measurement ID. Set only after you grant the Analytics category in the cookie banner. | Analytics | 2 years | Google (third-party, via our GA4 property) |
If we add or remove a cookie from this list, we will update this page and the "Effective" date at the top.
4. What we share with Google Analytics, and what we don't
When Google Analytics is enabled (after you grant consent), the data sent to Google for each page view includes the URL of the page, the referrer, an anonymized IP address, the approximate region derived from that IP, the screen resolution, the browser language, and the GA cookies described above. We use GA's IP Anonymization feature so the last octet of your IP address is dropped before the record is processed.
What we do not send to Google Analytics:
- Your email address, your name, or any other account-identifying field.
- The keywords you submit to Ranklet, or the contents of any brief you generate.
- Cross-device identifiers or any User-ID linking page views to a Ranklet account.
- Any data we capture on signed-in app pages. Google Analytics is loaded only on public marketing pages, not on authenticated app pages.
We do not use GA for remarketing, we do not enable Google Signals, and we do not load Google Tag Manager. Data flowing to Google LLC in the United States does so under Google's Standard Contractual Clauses; Google is independently certified under the EU-U.S. Data Privacy Framework as of the date of this policy.
5. How we obtain consent
On your first visit to a public Ranklet page, we show a cookie banner at the bottom of the screen. The banner gives you three clear choices:
- Accept all: strictly necessary cookies plus the Analytics category.
- Reject all: strictly necessary cookies only. Google Analytics is not loaded.
- Customise: choose categories individually.
The banner uses an "accept" and "reject" pair of equal-prominence buttons. We do not pre-tick the Analytics category. Until you make a choice, Google Analytics is not loaded.
We use Google's Consent Mode v2. Before you make a choice and if you reject Analytics, Consent Mode passes analytics_storage=denied so no GA cookies are set and only cookieless ping-counts are sent. If and when you accept Analytics, Consent Mode is updated to analytics_storage=granted and the GA cookies are written.
6. Changing your mind
You can change your cookie choice at any time:
- Click the link in the footer of any page. The banner re-opens and you can change your choice.
- If you grant consent and later withdraw it, we instruct Google Analytics to delete the
_gaand_ga_<ID>cookies on the next page load. You can also clear them directly through your browser at any time. - If you clear browser storage (cookies and
localStorage) for ranklet.io, the banner will reappear on your next visit, because the record of your previous choice is gone.
7. Controlling cookies in your browser
You can also control or block cookies through your browser's settings. The exact steps vary by browser; the major browsers all provide instructions:
If you block the strictly necessary _ranklet_session cookie, you will not be able to sign in or use the app. If you block the analytics cookies, the app still works fully, and we simply lose the ability to see aggregated visit data.
8. Do Not Track
We honour the Do Not Track (DNT) browser signal for analytics. If your browser sends a DNT header, we treat that as a signal that you do not consent to Analytics cookies, regardless of any prior choice in the cookie banner. In practice this means we do not load Google Analytics and the _ga cookies are not set, even if you previously clicked "Accept all".
We do not currently honour the Global Privacy Control (GPC) signal as a distinct preference because we do not "sell" or "share" personal information in the sense those terms have under the CCPA, so there is nothing for GPC to opt out of. We will revisit if this changes.
9. Changes to this policy
If we add a new cookie, change the retention of an existing one, or change the categories we use, we will update this page and the "Effective" date at the top. For material changes (for example, adding a new third-party analytics provider or a new category), we will give you notice in the cookie banner and, where the change requires fresh consent, prompt you to reaffirm your choice.
10. Contact
Questions about cookies or anything on this page: [email protected].