Cookies Policy

Cookies are small text files placed on your device. Related technologies include localStorage, sessionStorage, and pixels/SDKs. Some cookies are strictly necessary for the Site to function; others support analytics, marketing, or product improvement and are only set with your permission.

On your first visit a banner asks whether you accept non-essential cookies. Nothing non-essential is set until you click Accept. Your choice is stored in the rypl_consent cookie for six months, after which we ask again.

• Essential and functional cookies (security, sign-in, payments, remembering your choice, partner referral) are always set because the Site does not work without them.
• Analytics and marketing cookies are set only after you accept. If your browser sends a Global Privacy Control (GPC) signal we treat it as a decline, do not show the banner, and expire any marketing cookie already set — including one you accepted before turning GPC on.

A) Essential (strictly necessary)

Used to provide the Site and app securely. Cannot be switched off.

• Consent record — rypl_consent remembers your banner choice. Retention: 6 months.
• Session / authentication tokens — keep you signed in to app.rypl.is (HttpOnly, Secure, CSRF tokens). Retention: session or up to 30 days.
• Security & performance (Cloudflare) — e.g. cf_clearance, __cf_bm for bot management, and the Turnstile verification on our contact and withdrawal forms. Retention: 30 minutes – 1 year (vendor-controlled).
• Payments (Lemon Squeezy Checkout) — cookies set on *.lemonsqueezy.com for payment processing, fraud prevention, checkout state, and VAT compliance. Retention: session to 12 months.

B) Functional

Set to honour something you did on purpose. No third party receives them from this Site.

• Partner referral — if you arrive through a partner link (?aff=), the code is kept in sessionStorage as rypl_aff for the browser session and attached only to the app.rypl.is sign-up and affiliate links, so the partner who referred you is credited. It is never added to any other link, on this site or elsewhere.

C) Marketing (consent)

• OpenAI Ads attribution — if you arrive from an ad shown in ChatGPT the link carries a click id (?oppref=). With your consent we store it in the oppref cookie on .rypl.is for 30 days and append it to app.rypl.is links so the dashboard can attribute a sign-up to that ad. The id is opaque; this Site sends it nowhere else. Until you choose it stays in the page's memory and is never written to browser storage. If you decline, or later change your answer to a decline, the cookie is expired immediately and the id is dropped.
• Meta Pixel (Facebook) — _fbp (~3 months) for attribution, audiences, and campaign measurement. Loaded only with your consent, and only when enabled on the Site.

D) Analytics (consent)

Help understand how the Site is used and improve features. Loaded only with your consent, and only when enabled on the Site.

• Google Analytics 4 — _ga (~2 years), _ga_* (~2 years), _gid (~24h). IP anonymization/region controls used where available.
• Hotjar — _hjSessionUser_* (~1 year), _hjSession_* (~30 minutes), for UX insights (not keystrokes/passwords).

E) Third-party content

Some elements are loaded from other companies' servers, which may receive your IP address and browser details when they load. We do not control cookies those vendors may set on their own domains.

• Cloudflare Turnstile — the bot check on the contact and withdrawal forms (challenges.cloudflare.com).
• code.market — a small badge script.
• Product Hunt, There's An AI For That — “Featured on” badge images.

This Site writes one key to sessionStorage: rypl_aff, the partner referral code you arrived with (see 3B). It is cleared when the browser tab closes. Nothing else is written to localStorage or sessionStorage. Authentication tokens are not stored there; they are kept in secure cookies.

An OpenAI Ads click id that arrives before you have answered the banner is held in the page's memory only, not in any form of browser storage. It is written to the oppref cookie if you accept, and discarded if you decline or simply leave.

• Essential and functional cookies: legitimate interest in delivering a secure, functioning service and in honouring a partner link you chose to follow (Art. 6(1)(f) GDPR). Strictly necessary storage does not require consent under ePrivacy rules.
• Analytics & marketing cookies, including oppref: your consent (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive), given through the banner. You can withdraw it at any time (section 7); withdrawal does not affect processing that already took place.

Vendors (e.g., Cloudflare, Lemon Squeezy, OpenAI, Google, Meta) may process data in multiple countries. We rely on applicable safeguards (e.g., SCCs) as described in the Privacy Policy.

• Change your choice — clear your stored answer and the banner will ask again on the next page load.
• Browser controls — block or delete cookies in your browser. Blocking essential cookies may break the Site (login, checkout, payments).
• Global Privacy Control (GPC) — honoured as a decline of non-essential cookies.
• Vendor tools — e.g. Google Analytics Opt-Out Add-on, Meta Ads settings, where those services are enabled.
• Do Not Track (DNT) — not reliably supported across vendors; use the banner or GPC instead.

Rows marked “when enabled” describe tags that may be switched on in future; they are never loaded without your consent. Vendor cookie names and lifetimes may change.

• No warranty — This Policy is provided “as is” and may change as the Site, vendors, or laws evolve.
• Vendor variability — Third-party cookie names, lifetimes, and purposes can change without our control.
• Limitation of liability — To the maximum extent permitted by law, liability is disclaimed for indirect or consequential losses from reliance on this Policy. Liability is otherwise limited as set out in the Terms of Service.
• Conflicts — If this Policy conflicts with the Privacy Policy or Terms, the more specific document controls; otherwise, the Terms prevail.

We may update this Policy to reflect technology, vendors, or legal changes. Updates will be posted with a new date. Material changes may be notified via the Site.

Contact: [email protected]