Relentu

Legal · Cookie Policy

Cookie Policy

What we store on your device, why, and how to control it. Only two HttpOnly cookies plus a small set of preferences — no advertising, no cross-site tracking.

§ 1. Scope

  1. A cookie is a small text file a website places on a device so it can recognise the visitor between requests. Modern browsers also support related storage — localStorage, sessionStorage, IndexedDB. Throughout this policy "cookies" means all of these together.
  2. This Cookie Policy explains what Relentu stores on a device, why, and how to control it.
  3. It sits alongside the Privacy Policy, which covers how personal data is handled on the Operator's side.

§ 2. Two categories

  1. Strictly necessary — required for the platform to work. These cannot be disabled while using the platform.
  2. Optional (consent required) — analytics and error tracking. Off by default in the EU and EEA, and turned on only where accepted in the cookie banner or in Settings → Privacy.

§ 3. Cookies the Operator sets

  1. The following HTTP cookies are set by Relentu on its own domain.
Name Purpose Storage Lifetime Category
refreshToken Signed refresh token used to renew a sign-in session without asking for the password again. HttpOnly, Path=/auth, SameSite=Strict, Secure in production. HttpOnly cookie 30 days from issue, sliding Strictly necessary
uploadAccess Short-lived access token that lets the browser open images, audio and other protected uploads without an Authorization header. HttpOnly, Path=/uploads, SameSite=Strict, Secure in production. HttpOnly cookie 1 hour, refreshed with each sign-in Strictly necessary
refreshPersist Records whether "stay signed in" was chosen, so renewing a session keeps the length asked for instead of silently extending it. Holds 1 or 0 and nothing else. HttpOnly, Path=/auth, SameSite=Strict, Secure in production. HttpOnly cookie Same as refreshToken — 30 days, or until the browser closes where "stay signed in" was not chosen Strictly necessary
  1. Because these cookies are HttpOnly, page-level JavaScript cannot read them. This reduces the risk of theft by a compromised third-party dependency.

§ 4. Local browser storage

  1. The following entries live on the device, in localStorage or — where the row says so — in sessionStorage, which the browser empties when the tab closes. They are never transmitted to the Operator, with the one exception noted in the table.
Key Purpose Category
rl-language Remembers the interface language across visits. While signed in, that language is also saved to the account, so the app and the account setting agree. Strictly necessary
rl-language-scroll Where the page was scrolled to when the interface language was changed, so the reload lands back in the same place. In sessionStorage. Strictly necessary
rl-language-pending An interface language chosen before signing in, so that signing in during the same visit carries the choice to the account instead of replacing it. Sent to the Operator only as that account's language setting. In sessionStorage. Strictly necessary
cookieConsent The cookie choices made, so the question is not asked again. Strictly necessary
rl.consent.anonymousId A random identifier the cookie-consent record is filed under, so a choice made before signing up can be attached to the account afterwards. This one value is sent to the Operator with a consent record — never with anything else. Strictly necessary
rl_session_hint A non-sensitive flag that a signed-in session exists on this device. Strictly necessary
et_session_hint The former name of the entry above. Removed whenever it is found. Strictly necessary
rl-media-assets-version Which version of the background-effects runtime the browser has cached. Strictly necessary
rl-session-overlay-prefs Which panels were open during a live Session (participants, chat, notes) and their positions. Optional preference
rl.sounds.enabled Whether interface sounds (message, notification and classroom chimes) are switched on. Optional preference
classroom-panel-active-tab Which classroom side-panel tab was used last. Optional preference
rl-calendar-prompt-dismissed That the "connect your Google Calendar" prompt was closed. Optional preference
rl-recipient-lobby:displayName The name typed in a session lobby, so it need not be typed again. Optional preference
rl-recipient-lobby:knock-ts:<id> When a given Session was last knocked at, shared between tabs so the wait is consistent. One entry per Session. Optional preference
rl.legal.reaccept.dismissed Which updated documents were dismissed before they took effect. Optional preference
trialBannerDismissedOn That the trial-ending banner was closed. Optional preference
ed.banner.email-verify.dismissed That the "verify your email" banner was closed. In sessionStorage. Optional preference
ed.banner.past-due.dismissed That the payment-overdue banner was closed. In sessionStorage. Optional preference
rl.card.claim-account.dismissed That the "claim your account" card was closed. In sessionStorage. Optional preference
rl-card-views:<id> The card views saved in the Library and the filters each one restores. One entry for the list of views, one per view. Optional preference
rl.plan-intent Which plan was chosen before signing in, so checkout resumes where it left off. In sessionStorage. Strictly necessary
rl-classroom-handoff:<id> That a given classroom is being entered, so two tabs do not both try. One entry per Session. In sessionStorage. Strictly necessary
ed.classroom.returnUrl Where to return after leaving a classroom. In sessionStorage. Strictly necessary
  1. Everything marked Optional preference is removed by Settings → Privacy → Clear local data.
  2. The strictly necessary entries are not removed there: clearing the language would reset the interface mid-session, clearing the cookie choices would re-ask a question already answered, and clearing the consent identifier would orphan a consent record the Operator is obliged to be able to produce. All of it goes when site data for Relentu is cleared in the browser, or when the account is deleted.
  3. A small number of ed.* diagnostic switches are read by the application but never written by it. They exist so that an engineer can turn on verbose logging by hand while debugging.

§ 5. What is never stored

Cookies we will never set.

No third-party advertising cookies. No social-network re-marketing pixels. No cross-site behavioural profiles. No A/B-testing cookies that follow you across the web. No consent-management platform that buries a hundred vendor IDs behind one click.

§ 6. Third-party cookies

  1. A small number of sub-processors set their own cookies on their own domains when the user interacts with them through Relentu. They are described here for transparency; they live on the third-party domain, not on Relentu's.
Service Purpose Where the cookie is set Category Consent required
Stripe Fraud detection during payment. Set on Stripe's own hosted checkout page, which the user is sent to — Relentu loads no payment element of its own. stripe.com, js.stripe.com Strictly necessary for the payment page; not set anywhere else No — the cookie is required to process the specific transaction the user initiated
PostHog Anonymous product analytics — which screens people use, where flows get stuck. Set only after the "Product analytics" category has been accepted. eu.i.posthog.com (or the region the user is hosted in) Optional (analytics) Yes — off until accepted in the banner
Sentry Error and performance reporting. Set only after the "Performance & errors" category has been accepted. sentry.io Optional (performance) Yes — off until accepted in the banner
  1. The full sub-processor list, including where each vendor is hosted and what data-protection agreements are in place, is on the Sub-processors page.

§ 7. Control

  1. There are three layers of control: a) In-product — the cookie banner shown on the first visit allows accepting all, rejecting all optional, or customising category by category. Those choices can be revisited at any time from Settings → Privacy. b) Browser — every modern browser has a "site data" panel for Relentu, where entries can be inspected and deleted individually. c) Global — a browser can be set to block third-party cookies entirely. Relentu continues to work; only the third-party services listed in § 6 are affected.
  2. The Operator honours the Global Privacy Control (GPC) signal. Where a browser sends it, that is treated as a rejection of every optional cookie category, and the corresponding trackers are not set.

§ 8. Changes

  1. Where a cookie is added or removed, the tables above are updated.
  2. The version in force and the date it took effect are displayed on this page.
  3. A change that needs consent reaches the reader through the cookie banner rather than through this page.

§ 9. Contact

  1. Cookie questions: privacy@relentu.com.
  2. This policy is effective as of 2026-08-01.