Legal
Cookie Policy
What we store on your device, why, and how to switch off anything that is not strictly necessary.
Last updated: 15 October 2026
In force, some details still being finalised
This describes what we store on your device today. Every cookie listed below was checked against what the site actually sets, and the choice you make here takes effect immediately. Wording is still pending legal review alongside the Privacy Policy.
Showing: United States (detected from your connection, US).
Location detection is a convenience only. Your actual rights depend on where you live, not on what this page guessed.
1. What this covers
"Cookies" here means cookies and the equivalent storage a browser offers, such as local storage. We use very few, and we list every one of them below rather than describing them in categories and leaving you to guess.
We do not use advertising cookies, we do not run ad networks, and we do not sell or share this data with data brokers.
2. Strictly necessary
These make the site work. They cannot be switched off from here, because without them you could not stay signed in or move between pages.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| sb-<project>-auth-token | Supabase (our authentication provider) | Keeps you signed in. Without it you would be logged out on every page load. | Session, refreshed while you stay active |
| active_location_id | Runday | Remembers which of your locations you are currently looking at, so the calendar and staff pages show the right one. | Persistent until changed or cleared |
| __cf_bm and similar | Cloudflare | Bot detection and protecting the site from abuse. | Up to 30 minutes |
3. Functional
These remember a small preference. They do not identify you personally.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| runday_site_theme | Runday (browser local storage, not a cookie) | Created only if you choose the site’s look (light or dark) with the header’s button. It holds that choice, “light” or “dark”, so the next pages open in the same look. Nothing else, and it is never sent to our servers. | Persistent until you clear site data |
| runday_app_theme | Runday | Created only when a signed-in person chooses the app’s look (System, Light or Dark) in their settings. It holds that choice, “system”, “light” or “dark”, so the sign-in page opens in the same look on this device. Nothing else; the choice itself is kept in your account. | 1 year, or until another choice |
| runday_voter_token | Runday (browser local storage, not a cookie) | A random value so the public roadmap can tell one voter from another without asking you to create an account. It is not linked to your name or email. | Persistent until you clear site data |
| runday_ref | Runday | Set only if you follow a referral link from a Runday shop or a Runday partner (rundays.ca/r/…). It holds that link’s code, so that if you open your own shop, we know who sent you, give you 2 extra free weeks, and can thank them (a free month for a shop, a share of Runday’s first month for a partner; your price does not change). It holds nothing about you, and it is erased as soon as your shop is created. | 60 days, or until your shop is created |
| runday_stripe_state | Runday | Set only when a shop owner connects a Stripe account they already have, from their settings. It holds a random code that proves, when Stripe sends them back, that the answer is for them. It holds nothing about them, and it is erased on the way back. | 10 minutes, or until Stripe sends them back |
4. Analytics, and your choice
We use Google Analytics to count visits and see which pages people actually use. It is the only non-essential thing we load, and it is the only category you should have to make a decision about.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| _ga, _ga_<id> | Google Analytics | Counts visitors and shows which pages get used, so we know what to improve. This is the category you can decline. | Up to 2 years |
Analytics does not load until you accept it. Google's script is not placed on the page at all until then. Not loaded in a limited mode, simply absent. If you decline, or if you have not answered yet, no Google cookie is set and no request is made to Google from this site.
If your browser sends a Global Privacy Control signal, we treat that as a refusal without asking you again.
Your current setting
Loading your current setting…
Google Analytics processes data outside Canada. Its own handling is described in Google's privacy policy, and you can opt out across all sites with Google's browser add-on.
5. Controlling cookies yourself
Every major browser lets you see, block, and delete cookies for a site, usually under Privacy settings. Blocking the strictly necessary ones will sign you out and stop parts of Runday working. That is a consequence of blocking them, not a fault.
6. If you are outside Canada
To be written: United States, covering state-level opt-out signals including Global Privacy Control.
7. Questions
Email [email protected]. See also our Privacy Policy and Confidentiality Policy.