Company
The short cookie policy
Our application code does not write a single cookie. What it does write is two values into your browser's local storage, both of them needed for the dashboard to work. That is the whole policy, and the rest of this page just explains it.
What we do not offer
There is no cookie consent banner, because there is nothing to consent to. No Google Analytics, no advertising pixels, no Facebook or LinkedIn tags, no HubSpot, no session replay, no A/B testing tool. The old version of this page listed nine third-party trackers in a table and offered a preferences panel to switch them off. None of them were ever in this codebase.
What is stored on your device
Two keys, both in local storage, both first-party, neither sent anywhere except back to our own API as an Authorization header.
access_token
Your signed-in session. Written when you log in, removed when you log out. Without it the dashboard cannot tell who you are.
rp-theme
Light or dark. A preference, kept so the page does not flash the wrong colours on every load.
Why local storage rather than a cookie
A cookie is attached automatically by the browser to requests aimed at its domain, including requests a third-party page caused you to make. A token in local storage is attached only by our own client code, deliberately, on calls it makes itself. That removes a whole category of cross-site request problems, and it is why the session lives there.
It also means there is nothing for an advertising network to read. A cross-site tracker works by setting and reading a cookie on a shared domain; local storage is per-origin and cannot be read by another site at all.
Cookies you might still see on the domain
This site is served as static files by Cloudflare Workers. If your browser shows a cookie on roamingproxy.com, it was not set by our application code and is not read by it — there is no document.cookie access anywhere in this frontend. Nothing we build profiles you, and no advertising partner receives anything from this site, because there is no advertising partner.
What loads outside this site
Our CDN adds one outside request, and our typefaces now stay on our own origin. Both belong on this page because they are visible in your browser's network tab and used to be easy to miss.
Cloudflare Web Analytics
Our CDN adds a small script that records page views. It sets no cookie, stores nothing on your device, and does not follow you to other sites — it reports a page path and timing back to the same domain you are already on. It is the only analytics on this site, and there is still no Google Analytics, no advertising pixel and no session replay.
Typefaces (self-hosted)
Figtree and IBM Plex Mono are served from our own origin under /fonts/. No request goes to Google's font servers, so loading the site no longer discloses your IP address to Google for type. No cookie is set, and nothing about those font files identifies you to us.
Clearing it
Sign out, and the token is removed. Clear site data in your browser and both values go, which signs you out and resets the theme to your system setting. Nothing else changes: your account, keys and usage records live on our side and are governed by the Privacy Policy, not by anything in your browser.
Questions
- Why is there no cookie banner?
- Because a banner exists to collect consent for non-essential storage, and there is none here. Consenting to a sign-in token you already asked for by logging in would be theatre.
- Do you use Google Analytics?
- No, and there is no analytics package in this codebase at all. The old cookie table listed two Google Analytics cookies with a two-year expiry; neither existed. What we do have is Cloudflare Web Analytics, added by our CDN rather than by our code — it is cookieless and does not track you across sites. It is described above.
- Do you track me across other sites?
- No. The Privacy Policy says it in section 9: no advertising cookies and no cross-site trackers. See the do-not-sell page for what that means for your data.
Get a key
Create an account and mint an API key in the dashboard. The full endpoint reference — request shapes, parameters and error codes — is published at https://api.roamingproxy.com/v2/docs.