# Cookies — roamgap

> The cookies and local storage roamgap uses. Nothing is set before you consent;
> Do Not Track and Global Privacy Control are honoured as a reject. Source of
> truth: `specs/PRIVACY.md` §4 + §13.7.

## Cookies we may set

After consent only. Before consent: no cookies.

| Cookie | Set by | Purpose | Lifetime | Type |
| --- | --- | --- | --- | --- |
| `ph_<project_id>_posthog` | PostHog SDK | Anonymous distinct_id, session id | 1 year | Functional / analytics |
| `rg_consent` | App | Persist your consent choice | 1 year | Strictly necessary |
| Firebase Auth session | Firebase SDK | Maintain your login | 30 days | Strictly necessary |
| Checkout cookies | WiraPay / Paystack, on their own domains during checkout | Fraud prevention | Per provider | Strictly necessary |

## Storage when you're signed in

| Storage | Set by | Purpose | Lifetime |
| --- | --- | --- | --- |
| `firebaseLocalStorageDb` (IndexedDB) | Firebase Auth | Persist the signed-in session + refresh token | Until sign-out or clear |
| In-memory bearer | App | Authorize backend calls; never persisted | Page lifetime |

## Managing your choices

Reopen the consent controls any time from the "Manage cookies" button on
https://roamgap.ike.work/legal/cookies, or withdraw consent and analytics stop within a
minute.

## Source

- This page: https://roamgap.ike.work/legal/cookies
- Privacy policy: https://roamgap.ike.work/legal/privacy
- Sub-processors: https://roamgap.ike.work/legal/sub-processors