# Cookie policy

> The cookies and browser storage Railbed uses, and does not use, on railbed.io, the merchant dashboard and the hosted checkout, with what each one does.

Source: https://railbed.io/cookies/ · Last updated: 2026-09-25 · Railbed by DeepWork

Railbed uses as few cookies as it can. The marketing site sets none. The dashboard uses one session cookie and one browser storage key so that you can stay signed in and keep your Live/Test setting. Nothing on any Railbed host tracks you for advertising or analytics. This policy lists every item so you can check for yourself.

## What cookies and local storage are

A cookie is a small text file a website stores in your browser and sends back with later requests. Local storage is a similar browser feature that keeps a value on your device without sending it anywhere. Both can be viewed and cleared in your browser's settings.

## The marketing site

https://railbed.io sets no cookies and uses no analytics.

It loads its typefaces from Google Fonts. When your browser fetches a font, Google receives your IP address and standard browser information, as it would for any resource loaded from Google's servers. Google's privacy policy describes how it handles that data.

## The merchant dashboard

https://app.railbed.io uses:

- `rb_session`, a cookie that keeps you signed in. It is strictly necessary. It is marked HttpOnly (scripts on the page cannot read it), Secure (sent only over HTTPS) and SameSite=Lax (not sent by other sites), and it expires after 30 days or when you sign out.
- `railbed.mode`, a browser local storage key that records whether the Live/Test toggle is on. It contains no personal data and never leaves your browser.

## The hosted checkout

The checkout on pay.railbed.io sets no cookies. When you continue to a provider's page to pay, that provider's own cookie policy applies.

## Security cookies from our hosting provider

Cloudflare, which hosts and protects Railbed, may set strictly necessary cookies such as `__cf_bm` or `cf_clearance` when it screens traffic for bots or attacks. They are used only to tell legitimate visitors apart from automated traffic, and Cloudflare's own policy describes them.

## What we do not use

- No advertising cookies
- No analytics or measurement cookies
- No social media or embedded third-party tracking
- No cross-site tracking of any kind

## Managing cookies

Because every cookie we set is strictly necessary, the dashboard does not ask for cookie consent. You can delete cookies and local storage through your browser settings. If you delete `rb_session` you will be signed out, and if you block cookies entirely you will not be able to sign in to the dashboard.

## Changes and contact

We will update this page if the cookies we use change; the date at the top shows the latest version. Questions go to [privacy@railbed.io](mailto:privacy@railbed.io). The [privacy policy](https://railbed.io/privacy/) explains everything else we do with personal data.