Cookies Policy

Cookies are small text files placed on your device. Related technologies include localStorage, sessionStorage, and pixels/SDKs. Some cookies are strictly necessary for the Site to function; others support analytics, marketing, or product improvement and are only set with your permission.

On your first visit a banner asks whether you accept non-essential cookies. Nothing non-essential is set until you click Accept. Your choice is stored in the rypl_consent cookie for six months, after which we ask again.

• Essential and functional cookies (security, sign-in, payments, remembering your choice, partner referral) are always set because the Site does not work without them.
• Analytics and marketing cookies are set only after you accept. If your browser sends a Global Privacy Control (GPC) signal we treat it as a decline, do not show the banner, and expire any marketing cookie already set — including one you accepted before turning GPC on.

Before you choose, and after a decline, we still count visits in a way that stores nothing on your device: see PostHog in section 3D.

A) Essential (strictly necessary)

Used to provide the Site and app securely. Cannot be switched off.

• Consent record — rypl_consent remembers your banner choice. Retention: 6 months.
• Session / authentication tokens — keep you signed in to app.rypl.is (HttpOnly, Secure, CSRF tokens). Retention: session or up to 30 days.
• Security & performance (Cloudflare) — e.g. cf_clearance, __cf_bm for bot management, and the Turnstile verification on our contact and withdrawal forms. Retention: 30 minutes – 1 year (vendor-controlled).
• Payments (Lemon Squeezy Checkout) — cookies set on *.lemonsqueezy.com for payment processing, fraud prevention, checkout state, and VAT compliance. Retention: session to 12 months.

B) Functional

Set to honour something you did on purpose. No third party receives them from this Site.

• Partner referral — if you arrive through a partner link (?aff=), the code is kept in sessionStorage as rypl_aff for the browser session and attached only to the app.rypl.is sign-up and affiliate links, so the partner who referred you is credited. It is never added to any other link, on this site or elsewhere. Keeping it beyond this visit needs your consent (see C).

C) Marketing (consent)

• OpenAI Ads attribution — if you arrive from an ad shown in ChatGPT the link carries a click id (?oppref=). Until you answer the cookie banner, the id stays in the page's memory only and is passed along in the link if you continue to app.rypl.is, so the dashboard can attribute a sign-up to that ad; it is not written to browser storage on this Site. With your consent we also store it in the oppref cookie on .rypl.is for 30 days. The id is opaque; this Site sends it nowhere else. If you decline, or later change your answer to a decline, the cookie is expired immediately and the id is dropped and no longer passed along.
• Partner referral, 30 days — with your consent, the partner code you arrived with (see B) is also stored in the rypl_aff cookie on .rypl.is for 30 days, so the partner is credited if you come back and sign up later. A newer partner link replaces it. If you decline, or later change your answer to a decline, the cookie is expired immediately.
• Meta Pixel (Facebook) — _fbp (~3 months) for attribution, audiences, and campaign measurement. Loaded only with your consent, and only when enabled on the Site.

D) Analytics

Help us understand how the Site is used and improve it. In both modes, ad click ids and partner codes in page addresses and links (such as oppref and aff) are masked in the browser before anything is sent to PostHog. PostHog works in two modes, depending on your choice:

• PostHog, before you choose or after a decline or GPC signal — counts page views, clicks and page performance without cookies or any browser storage. PostHog's servers derive a visitor identifier from a hash of your IP address, your browser's user agent and a salt that changes every day and is then deleted, so visits cannot be linked from one day to the next and the identifier cannot be traced back to you. Session replay is off in this mode.
• PostHog, after you click Accept — sets ph_<project key>_posthog on .rypl.is for 1 year, shared with app.rypl.is so that a visit to the Site and a later sign-up are recognised as the same person, plus the localStorage and sessionStorage entries listed in section 4. PostHog also records session replays of the pages you visit, with text typed into form fields masked. Data is stored in PostHog Cloud EU.

Homepage headline test — if you arrive from an ad or a partner link, the homepage shows one of two headlines, picked at random by our server, and PostHog records which one you saw. Before you choose, or after a decline, the pick is made again on every visit and nothing is stored in your browser. With your consent we keep it in the rypl_ab_hero cookie on www.rypl.is for 30 days, so you see the same headline when you come back. If you decline, or later change your answer to a decline, the cookie is expired immediately.

The following tools are loaded only with your consent, and only when enabled on the Site:

• Google Analytics 4 — _ga (~2 years), _ga_* (~2 years), _gid (~24h). IP anonymization/region controls used where available.
• Hotjar — _hjSessionUser_* (~1 year), _hjSession_* (~30 minutes), for UX insights (not keystrokes/passwords).

E) Third-party content

Some elements are loaded from other companies' servers, which may receive your IP address and browser details when they load. We do not control cookies those vendors may set on their own domains.

• Cloudflare Turnstile — the bot check on the contact and withdrawal forms (challenges.cloudflare.com).
• Product Hunt, code.market, There's An AI For That — “Featured on” badge images.

This Site writes one key to sessionStorage: rypl_aff, the partner referral code you arrived with (see 3B). It is cleared when the browser tab closes. If you accept analytics cookies, PostHog also writes rypl_ph_consent and ph_<project key>_* entries to localStorage and sessionStorage (see 3D); they are deleted if you later decline or change your choice. Nothing else is written to localStorage or sessionStorage. Authentication tokens are not stored there; they are kept in secure cookies.

An OpenAI Ads click id that arrives before you have answered the banner is held in the page's memory only, not in any form of browser storage. It is written to the oppref cookie if you accept, and discarded if you decline or simply leave.

• Essential and functional cookies: legitimate interest in delivering a secure, functioning service and in honouring a partner link you chose to follow (Art. 6(1)(f) GDPR). Strictly necessary storage does not require consent under ePrivacy rules.
• Cookieless analytics (PostHog before consent): legitimate interest in measuring how the Site is used (Art. 6(1)(f) GDPR). No cookies or browser storage are used, and the visitor identifier is a daily-salted hash computed on PostHog's servers.
• Analytics & marketing cookies, including oppref: your consent (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive), given through the banner. You can withdraw it at any time (section 7); withdrawal does not affect processing that already took place.

Vendors (e.g., Cloudflare, Lemon Squeezy, OpenAI, Google, Meta) may process data in multiple countries. PostHog stores our analytics data in the EU. We rely on applicable safeguards (e.g., SCCs) as described in the Privacy Policy.

• Change your choice — clear your stored answer and the banner will ask again on the next page load.
• Browser controls — block or delete cookies in your browser. Blocking essential cookies may break the Site (login, checkout, payments).
• Global Privacy Control (GPC) — honoured as a decline of non-essential cookies; PostHog then only counts visits in its cookieless mode.
• Vendor tools — e.g. Google Analytics Opt-Out Add-on, Meta Ads settings, where those services are enabled.
• Do Not Track (DNT) — not reliably supported across vendors; use the banner or GPC instead.

Rows marked “when enabled” describe tags that may be switched on in future; they are never loaded without your consent. Vendor cookie names and lifetimes may change.

• No warranty — This Policy is provided “as is” and may change as the Site, vendors, or laws evolve.
• Vendor variability — Third-party cookie names, lifetimes, and purposes can change without our control.
• Limitation of liability — To the maximum extent permitted by law, liability is disclaimed for indirect or consequential losses from reliance on this Policy. Liability is otherwise limited as set out in the Terms of Service.
• Conflicts — If this Policy conflicts with the Privacy Policy or Terms, the more specific document controls; otherwise, the Terms prevail.

We may update this Policy to reflect technology, vendors, or legal changes. Updates will be posted with a new date. Material changes may be notified via the Site.

Contact: privacy@rypl.is