Official Marketplace Standard
runcollab Cookie Policy
Effective Date: October 2026 · Minimal Session Storage & Zero Ad Tracking Guarantee
Encrypted HttpOnly session cookies for authentication and CSRF defense.
Client-only browser localStorage caching for dark mode, currency, and tabs.
No third-party advertising pixels, cross-site trackers, or data broker sales.
| Cookie / Key Name | Purpose | Expiry | Storage Layer |
|---|---|---|---|
| authjs.session-tokenStrictly necessary | NextAuth encrypted session cookie for authenticated states. Keeps you signed in between page navigations and verifies your access to escrow balances, applications, and workspace ledgers. | 30 days (rotated on role change) | HTTP-only cookie · Secure · SameSite=Lax |
| authjs.csrf-tokenStrictly necessary | CSRF anti-forgery token for API mutation endpoints (sprint brief creation, application submissions, escrow actions). Protects against cross-site request forgery of financial state changes. | Session | Cookie · SameSite=Lax |
| runcollab_currencyPreference | User currency display preference ("INR" or "USD"). Caches your selected pricing denomination across the marketplace board, briefs, and escrow ledgers. | Persistent | localStorage · Browser only |
| runcollab_notifications_statePreference | Caches cleared notification timestamps and dismissed alert IDs so unread badge counts stay accurate across tab navigations without repetitive server polling. | Persistent | localStorage · Browser only |
| data-themePreference | Workspace visual preference set by the theme toggle ("dark" or "light"). Caches your selected layout theme so it renders immediately without flashing. Never transmitted to the server. | Persistent | localStorage · Browser only |
| runcollab.preferencesPreference | JSON-encoded workspace visual preference snapshot (compact sidebar mode, accent color choice, filter bar defaults). Stored strictly client-side. | Persistent | localStorage · Browser only |
1. Zero Third-Party & Advertising Cookies
runcollab drops zero third-party advertising cookies and does not install tracking pixels or retargeting beacons. Payment flows are handled directly by Razorpay on their secure domain—any cookies set during a Razorpay transaction are governed by the Razorpay Privacy Policy, rather than runcollab.
2. Essential NextAuth Authentication Tokens
The authjs.session-token cookie is the primary browser credential runcollab uses. Its payload is an opaque, encrypted JWT produced by NextAuth and contains your user ID, email, and active role. It is:
- Flagged HttpOnly: Client-side JavaScript cannot read the token, providing robust cross-site scripting (XSS) immunity.
- Flagged Secure: Transmitted strictly over HTTPS in production builds, blocking transport interception.
- Flagged SameSite=Lax: Never attached to third-party subrequests, preventing cross-site request forgery against escrow endpoints.
- Role-Based Invalidation: Actively rotated whenever a user switches or elevates roles (e.g. CREATOR ↔ ADMIN). Stale tokens are immediately rejected.
3. Performance & Operational Telemetry (Zero Ad Tracking)
runcollab collects minimal first-party performance telemetry strictly to measure API response latency, escrow mutation confirmation speeds, and platform error rates across client workspaces.
- Zero Behavioral Ad Profiling: We do not track you across other websites, build marketing profiles, sell user metrics to data brokers, or run retargeted advertisements.
- First-Party Operational Integrity: Telemetry metrics (such as WebSocket real-time handshake health and Razorpay webhook processing latency) are pseudonymized and used exclusively to guarantee our 48-hour sprint SLA and transaction safety.
4. Workspace Preference & Local Storage
The Preferences panel writes two keys to browser window.localStorage when you customize your workspace:
data-theme: String literal"dark"or"light". Applied directly to the HTML document to avoid visual flashes upon page loads.runcollab.preferences: Small JSON blob (under 2 KB) for UX preferences like compact sidebar, default niche filter, and campaign sorting order.
Neither key is ever transmitted to the server in request headers, bodies, or URL queries. They exist purely client-side to preserve your workspace visual layout.
5. How to Manage or Clear Cookies
Signing out via the top-right user menu clears the NextAuth session and CSRF cookies automatically. To wipe workspace preferences:
- Open browser DevTools → Application / Storage → Local Storage → select
clear(). - Because our primary session credential is
HttpOnly, it cannot be tampered with or cleared by arbitrary JavaScript. Use your browser's cookie manager or sign out via the application menu.
6. Policy Modifications & Inquiries
We will update the Effective Date above whenever we add, remove, or reclassify a cookie. Any material additions (e.g. adding new third-party providers, which we have no current plans to do) will be announced 30 days in advance via in-app banner.
For questions regarding cookies or session security, reach out to our privacy desk at privacy@runcollab.app or open the Contact & Support desk.
Minimal by Design: runcollab operates entirely on four storage keys total—two server-issued cookies for session authentication and CSRF defense, and two client-only keys for your visual layout. No advertising trackers, ever.
Questions Regarding Privacy or Session Security?
Our Security and Compliance team is available around the clock.