Cookie policy

We store two things in your browser and each has one job. The cookies that keep you signed in, which are Clerk’s; and, once you are signed in, one cookie of ours that remembers which of your sites you last had a rota open for, so that it opens on that one. There are no analytics cookies, no advertising cookies, no third-party trackers, no pixels and no fingerprinting. Nothing we set reaches the browser of somebody who has not signed in. Clerk’s sign-in script is loaded on the public pages as well, so that signing in works from wherever you are when you decide to, and section 5 says what that means.

The sign-in cookies. Authentication is handled by Clerk, our authentication provider, and these are Clerk’s. They are set in the course of the sign-in exchange between your browser, rotaaa.app and Clerk, and what they do is carry that exchange and keep you signed in afterwards, so that every page you open knows who you are without asking again.

They are strictly necessary in the sense the law uses: without them there is no way to stay signed in from one page to the next, which is the entire product. They cannot be switched off without signing out, and there is nothing to consent to, because refusing them is refusing the service you asked for.

How many there are, what they are called and how long each lasts are Clerk’s to set, and they differ between a development instance and a production one, so they are not printed here — a list that is wrong is worse than a description that is right. The current list is published in Clerk’s own documentation at clerk.com.

The site memory. Inside the product we set one cookie of our own. It holds the identifier of the site whose rota you last had open, under a name that includes your organisation’s address on rotaaa.app, and it lasts a year. It is there because a planner who runs the fourth of your sites should not have to start at the first one every morning.

It is a default, not a permission. The identifier in it is re-checked against the sites you are actually allowed to open on every request, so one left behind in a shared browser can never show anybody something they could not already reach. It holds nothing about you — no name, no account, no address — and it is written by your browser after a page has loaded, only when you are signed in, and never on the public pages. Clearing this site’s cookies removes it, and the rota opens at your first site until you pick another.

The law treats anything stored on or read from your device the same way, whether or not it is a cookie, so this covers the rest of it.

Rotaaa writes nothing to your browser’s local or session storage. A theming script reads a theme value before the page paints, but nothing ever sets one: the product renders in light mode only and has no theme switch. If a value is there, it is left over from an earlier visit, and it is never sent anywhere.

That is the one claim on this page a single careless import could falsify, and version 1.0 of this policy did get it wrong — it said a theme preference was remembered when nothing was writing one. So it is re-checked at each release rather than assumed, and if it ever stops being true this page is revised before the storage starts.

Clerk’s own script may use browser storage as part of maintaining your session. That is part of the sign-in described above, and is covered by the same necessity.

Regulation 6 of the Privacy and Electronic Communications Regulations requires consent before information is stored on, or read from, your device — unless that storage is strictly necessary for a service you have explicitly requested. Two things are stored, and the answer is not identical for both, so this takes them in turn.

The sign-in cookies are that service. You asked to sign in; there is no way to deliver a signed-in session without them; refusing them is refusing what you asked for. The exception applies squarely, and a banner would offer you nothing you could sensibly decline.

The site memory is a convenience rather than a mechanism, and it is worth being exact about it. It is set only after you have signed in, only inside the product, and only once you have opened a rota at a particular site — so what it records is a choice you made in the course of the service you asked us for, and it is limited to remembering that one choice. It holds no personal data, it is read by nothing but the rota screens, and clearing it costs you one click to pick your site again. On that basis we treat it as part of delivering the product to somebody who has signed in, rather than as something to ask for separately.

That leaves the pages you can reach without an account. We store nothing on those — the sign-in cookies arrive when you sign in, the site memory exists only inside the product — and the one thing loaded there that is not ours is Clerk’s sign-in script, which is there so that signing in works from wherever you are, and whatever it uses in your browser belongs to the sign-in it performs. That is why those pages carry no banner.

One thing, and it is the sign-in. Clerk’s script is loaded on every page of the site, including this one, so that signing in works from wherever you happen to be when you decide to. Loading it means your browser contacts Clerk.

Nothing else. There is no embedded video, no map, no social button, no comment widget, no advertisement and no analytics tag anywhere on this site, and the typefaces are served from rotaaa.app rather than fetched from a font service — they are downloaded once when the site is built, not once by every reader.

That matters beyond cookies: a request to a third party hands that third party your address and the page you were reading, with or without a cookie attached. The sign-in script is the only such request a public page here makes.

Every browser can block or clear cookies for a site, usually from the padlock in the address bar or from the privacy section of its settings.

Doing it here has a predictable cost and no hidden one: the public pages — the home page, this policy, the rest of the site — keep working exactly as they do now; the product signs you out and cannot sign you back in until the block is lifted; and the site memory goes with it, so the rota opens at your first site until you pick another. Nothing else is lost.

Adding anything that is not strictly necessary — a product analytics tool, a chat widget, an error reporter that runs in your browser — means revising this page first and asking for your consent before it runs, not after. That is the order the law requires and the order we hold ourselves to. As of version 3.0, nothing of the kind is present.

Every revision carries a version number, an effective date and a list of what moved, at the top of this page. That is how you would see it had happened. What is held about you more broadly, and the rights you have over it, are set out in the privacy notice.