RiftbotCookie Notice
This notice explains the cookies, browser storage, and similar technologies Riftbot uses, including which are necessary and which require your choice.
Effective August 20, 2026 · Last updated September 20, 2026
1. What these technologies are
Cookies are small text records a website asks your browser to store and return. Local storage keeps information in your browser without sending it automatically with every request. Riftbot also uses an affiliate-attribution script and optional product-analytics scripts.
2. Your choice
Necessary technologies support sign-in, chat identity, watchlists, security, and your saved privacy choice. They operate when the related feature is used. “Accept” allows optional analytics and Google Ads measurement; “Decline” rejects both. “Customize” lets you choose Analytics and Marketing separately under Non-essential. PostHog, Vercel and GA4 require analytics consent; Google Ads requires marketing measurement consent. Riftbot does not use session replay or ad personalization.
Affiliate links help fund Riftbot through commissions at no extra cost to you. The Impact script loads on page visits to prepare eligible affiliate links and record impressions, independently of your optional product-analytics choice. Declining analytics does not disable affiliate links or Impact. Impact and linked marketplaces may use attribution cookies or similar technologies under their own policies.
3. Technologies Riftbot uses
| Technology | Category and purpose | Typical duration |
|---|---|---|
riftbot-visitor | Necessary: signed pseudonymous chat identity, security, and request limits | Up to 1 year |
riftbot-watchlist | Necessary: mirrors starred card identifiers for server-side filtering | Up to 1 year |
sb-<project-ref>-auth-token and numbered cookie chunks | Necessary when signed in: authenticates and refreshes your Riftbot session | Up to 7 days, renewed while the session is active; removed on sign-out |
sb-<project-ref>-auth-token-code-verifier | Necessary during Google sign-in: protects and completes the redirect flow | Removed after the sign-in exchange or expires within 7 days |
riftbot-marketing-consent | Necessary during sign-in: carries your optional email-marketing choice through the Google redirect | Removed on the sign-in callback or after 10 minutes |
Local storage: riftbot-watchlist | Necessary: keeps starred card identifiers in this browser | Until you clear it or remove the items |
Local storage: riftbot-onboarding and riftbot-onboarding-completed-at | Necessary: records the completed introduction version and time so anonymous visitors see it again after three days | Until you clear it |
Local storage: riftbot-watchlist-imported:* | Necessary after sign-in: prevents repeated anonymous-watchlist imports | Until you clear it |
Local storage and first-party cookies: riftbot-analytics-consent and riftbot-advertising-consent | Necessary: remembers separate analytics and advertising-measurement choices | Local storage until cleared; cookie copies up to 90 days, renewed from your saved choice |
riftbot-attribution | Optional: remembers landing campaign parameters and, with Marketing enabled, the Google click ID. Links an anonymous eBay click to reported affiliate commission; no signup, email address, or account ID is needed. | Up to 90 days from capture; a new tagged campaign replaces it. Declining Marketing removes the Google click ID. Declining both optional choices removes the cookie. |
Google Analytics 4 tag and _ga / _ga_* cookies | Optional: page views and the separate ebay_outbound_click event, using a pseudonymous browser identifier. Outbound clicks are not purchase revenue. | Only with Analytics enabled; Google analytics cookies may last up to two years |
| PostHog first-party local storage | Optional: pseudonymous product analytics, page use, navigation, and interactions | Only after consent; until withdrawn, cleared, or no longer needed |
| Vercel Analytics script | Optional: cookieless page-view and web-usage measurement | Runs only while analytics consent is enabled |
| Google Ads tag: AW-18454693990 | Optional: advertising measurement, including completed sign-ups with a nominal USD 1 value and a random event identifier to prevent duplicates. With advertising measurement consent, Google may store ad cookies and process visits, signups, and eBay outbound clicks for attribution. Outbound clicks have no purchase value. Separately, clicks recorded with Marketing enabled may be matched to EPN purchases and sent to Google with the earned affiliate commission, currency, purchase time, and transaction ID. Ad personalization remains disabled. | Loads only after advertising measurement consent. Withdrawal sends a denied update; an already-loaded tag may send cookieless consent signals until the page closes. |
Google advertising-measurement cookies, such as _gcl_au | Optional: link ad interactions to conversions after advertising measurement consent | Typically up to 90 days; you can clear cookies in your browser |
riftbot-signup-conversion | Short-lived sign-up completion marker; sent to Google only if advertising measurement is allowed. Contains a random event identifier, not your account ID or email. | Up to 10 minutes; removed when the conversion is queued or advertising measurement is declined. |
Impact affiliate script: utt.impactcdn.com | Affiliate attribution: prepares eligible links and records impressions; loads independently of optional product analytics | Loads on page visits. Provider-held records and any provider cookies follow Impact’s Privacy Policy. |
4. Managing stored information
You can change your analytics and advertising measurement choices at any time using “Cookie settings” on this page, accessible through the Cookies link. Changes apply across open Riftbot tabs in this browser. Declining analytics stops future PostHog, Vercel Analytics and GA4 event collection and resets the active PostHog identity. Declining Marketing removes the stored Google click ID, stops new ad-attributed outbound clicks and browser conversion events, and sends Google a denied consent update. Already-loaded tags may send cookieless consent signals until the page closes. Commissions from clicks recorded while Marketing was enabled may still be reconciled using that click-time choice. Withdrawal does not disable affiliate links or erase existing server/provider records. You may request deletion as described in the Privacy Policy, or clear browser storage. Doing so may sign you out, clear a local watchlist, restart onboarding, create a new chat visitor identifier, or cause this notice to ask for your choice again.
Browser settings can block all cookies, but blocking necessary cookies may prevent sign-in, chat continuity, watchlist filtering, or security controls from working correctly.
5. Related information and changes
The Privacy Policy explains the personal information associated with these technologies, the providers that receive it, retention, and your rights. This notice may change when Riftbot’s features or providers change. The “Last updated” date identifies the current version.