Privacy
Cookies and Browser Storage
Every cookie and piece of browser storage the site uses — all of them needed for it to work.
In short
RPM uses only what it needs to work: two cookies to keep you signed in safely, and a little browser storage to remember how you left the screen. No analytics, advertising, social media or tracking cookies, and nothing that follows you to other websites. Because everything here is strictly necessary, we do not ask for cookie consent — the law (such as the EU ePrivacy Directive and the UK's PECR) exempts it. A video in a blog post is the one exception you choose yourself: nothing loads from YouTube until you press Play (see Videos, below).
Cookies
| Name | What it does | How long |
|---|---|---|
| JSESSIONID | Keeps you signed in, and fixes the company you work in for the session. Not readable by scripts. | Until you sign out, close the browser, or the session expires after inactivity |
| XSRF-TOKEN | Protects your session from cross-site request forgery: another site cannot act as you. | The session |
Both are set by RPMCODE's own server when your browser first talks to it. Dashboards use the same session; they set no cookie of their own.
Browser storage
| Name | What it remembers | How long |
|---|---|---|
| rpm.tenantCode (local storage) | The company you last worked in | Until your next sign-in replaces it, or you clear it |
| rpm.sidebarCollapsed (local storage) | Whether you folded the side menu | Until you clear it or sign in again |
| rpm.menuSections (local storage) | Which side menu sections you opened | Until you clear it or sign in again |
| rpm.scout.collapsed:… (local storage) | Which Scout panels you collapsed | Until you clear it |
| pwa:cold-start-update (session storage) | That an update has already been applied this visit | Until the tab closes |
| Application cache (service worker) | RPM's own program files, so it starts quickly and can be installed as an app. Never your business data. | Until the next update or you uninstall |
Fonts
The typefaces on the public pages and in the colour themes are served from RPM's own servers, together with the page. Your browser makes no request to Google or any other company to show them.
Videos
Some blog posts show a short video that is hosted on YouTube. Until you press Play, the post shows a picture served by RPM's own server, and your browser makes no request to YouTube.
Pressing Play loads YouTube's privacy-enhanced player (youtube-nocookie.com) in the post. From then on YouTube, which is Google's, receives your internet address and may keep cookies and browser storage of its own, under YouTube's terms and Google's privacy policy. We send YouTube nothing about you. If you'd rather it didn't, don't press Play. The list of scenes under each video says what it shows.
Your choices
You can block or delete cookies and storage in your browser's settings. If you block the two cookies above, you cannot sign in. Clearing storage only resets the preferences listed. Since we do no tracking, "Do Not Track" and Global Privacy Control signals change nothing — there is nothing to switch off.