Cookie policy.
Three cookies, no banner.
1. Scope
This policy covers this website and the account portal served from the same origin: the public pages, sign-in and registration, and the screens where you manage your organization, devices and annual licence.
It does not cover two things that are easy to confuse with it:
- Stripe Checkout and the Stripe billing portal. Those pages run on Stripe's own domains, not ours, and set Stripe's own cookies under Stripe's own policies. See section 5.
- The RERUN desktop application. It is a local runtime, not a website, and the cookies it handles never reach this service. See section 6.
Cookies that identify you are also personal data. How that data is used is described in the privacy policy.
2. Cookies this site sets
Three, and only three. All of them are first-party, set by this application, and required for the site to work at all. Two are set on your first request, before you have signed in or entered anything, because the sign-in form cannot be protected without them. The third is set only if you ask for it.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| rerun-session | Attaches your browser to its server-side session: sign-in state, the cross-site request forgery token, one-off status messages and the organization you have selected in the portal. The cookie carries an encrypted session identifier and nothing else — the session record itself is stored in our database, not in your browser. | 120 minutes from your last request | Strictly necessary · first party |
| XSRF-TOKEN | Carries the request-forgery token that every form on this site must send back, so that another site cannot submit actions on your behalf. Readable by this page's own scripts by design; the value is encrypted and is not valid anywhere else. | 120 minutes | Strictly necessary · first party |
| remember_web_… | Set only if you tick Keep me signed in on this device when you sign in. It lets that one browser re-authenticate without your password. Signing out deletes it. The trailing characters of the name are a fixed value produced by the framework, not an identifier for you. | 400 days, or until you sign out | Strictly necessary, on your explicit request · first party |
How they are protected
- Values are encrypted by the application before they reach your browser. A cookie copied out of your browser is not readable and is not accepted on any other origin.
- All three are scoped to this host only — no wildcard domain — and to the path /.
- All three carry a SameSite restriction — Lax at minimum — so they are not sent with the cross-site requests that could act on your behalf.
- rerun-session and the sign-in cookie are HttpOnly: page scripts cannot read them. XSRF-TOKEN is deliberately readable, because the token has to be echoed back with each request.
- In production the service refuses to start unless cookies are marked Secure, HttpOnly and SameSite. This is a boot check, not a convention: a deployment configured any other way fails closed rather than serving you an insecure cookie.
3. What this site does not set
No analytics cookies. No advertising or retargeting cookies. No tag manager. No session recording or heatmaps. No social, video or chat embeds. No third-party pixels of any kind.
Nothing on these pages is loaded from anyone else's server. Typefaces are compiled into our own build and served from this origin, so reading this page makes no request to a font provider. The site ships a content security policy that allows scripts, styles, fonts and network connections from this origin only, and images from this origin or inline data only, which means your browser would refuse a third-party tracker even if one were added by mistake.
This is a product decision, not an oversight. RERUN is sold on the premise that your data stays on machines you control; a marketing site that leaked your visit to four ad networks would contradict the product.
5. Stripe pages are not this site
Payments are handled by Stripe. When you start a subscription or open the billing portal, this site sends you away to a page on checkout.stripe.com or billing.stripe.com. The redirect target is verified against those exact hosts before you are sent anywhere.
While you are on those pages you are on Stripe's site, and Stripe sets its own cookies for payment processing and fraud prevention. Those cookies are governed by Stripe's own notices, published at stripe.com/legal; we cannot read them, and they are not set on this domain.
The distinction matters: no Stripe script, iframe or fraud-detection beacon runs on this site. Stripe only sees you once you have chosen to go there.
6. Cookies inside the RERUN desktop app
The RERUN desktop runtime works with cookies belonging to the applications you test. That is a different thing from this website, and worth stating plainly:
- Cookies imported into RERUN live in an isolated browser profile on your Mac. They are never sent to this service, which has no endpoint capable of receiving them.
- RERUN does not read your Chrome profile, password store, history, saved cards or extensions. An import is an explicit action on a file you choose, is validated, is bounded to five domains and 500 cookies, and requires confirmation.
- Resetting the RERUN web profile clears those cookies along with local storage, IndexedDB, cache storage, service workers and HTTP and auth caches, and requires a second confirmation before it does.
Nothing in this section produces a cookie in the browser you are reading this page with.
7. Controlling cookies in your browser
Every major browser lets you view, block and delete cookies for a specific site, and lets you clear them on exit. Those controls apply to this site like any other, and you do not need our permission to use them.
One consequence is worth knowing in advance: blocking the cookies in section 2 does not reduce tracking, because there is none. It prevents you from signing in, because the portal cannot keep a session or validate a form without them. The public pages remain readable.
Deleting the sign-in cookie, or signing out, ends that browser's ability to re-authenticate without your password. You can also deactivate a registered device from your account page, which is a separate control and applies to the desktop application rather than to this website.
8. Changes and contact
If we ever add a cookie, this page changes before the cookie ships, and the date at the top changes with it. If a cookie is ever added that is not strictly necessary, it will not be set until you have consented to it, and a consent mechanism will appear on this site.
Questions about this policy go to Privacy contact email — to be completed . Details of the company operating this site are on the legal notice; how we handle personal data is in the privacy policy.