Cookie policy
Rotevia uses as few cookies as it can get away with, and asks before setting anything that is not essential.
Last updated 3 September 2026
The short version
Four cookies keep the product working: one signs you in, one remembers which business you are in, one secures Google sign-in, and one remembers your answer to this question. Nothing else is set unless you say yes.
There are no advertising cookies, no cross-site trackers and no third-party pixels on any Rotevia page.
Every cookie we set
| Cookie | Category | What it does | Lasts |
|---|---|---|---|
rotevia_session | Strictly necessary | Keeps you signed in. Contains a random session token and nothing else: no name, email or role. http-only, so page scripts cannot read it. | 30 days, or until you sign out |
rotevia_active_membership | Strictly necessary | Remembers which business you are working in when your account belongs to more than one, so the rota you open is the one you expect. | 30 days, or until you sign out |
rotevia_oauth | Strictly necessary | Set only when you choose 'Continue with Google'. Holds the one-time values that prove the sign-in coming back from Google is the one you started. | A few minutes |
rotevia_consent | Strictly necessary | Records the cookie choice you made on this page or in the banner, so we do not ask again on every visit. | 12 months |
Where Rotevia is served from two hosts, the marketing site and the signed-in app, the session cookies are scoped to the shared parent domain so that signing in on one works on the other. They are still first-party cookies, set by us and readable only by us.
Strictly necessary cookies
These four are exempt from consent under the Privacy and Electronic Communications Regulations, because without them the service you asked for cannot be delivered: you could sign in, but the next page you opened would not know who you were.
You can block them in your browser, and Rotevia will still load, but you will not be able to stay signed in.
Analytics
We would like to count page views and a small set of product events, such as an employee being added or a rota being published, so we can see which parts of Rotevia are actually used and stop maintaining the parts that are not.
Where analytics is enabled, the provider is a cookieless, privacy-preserving one: it sets no cookie at all, does not fingerprint your device and does not follow you to other sites. It is loaded only after you agree, and never receives names, email addresses, pay rates, employee identifiers or the contents of any record. Page addresses are stripped of identifiers and query strings before they are reported, so /employees/42?tab=notes is counted as /employees/:id.
Nothing loads and nothing is sent until you choose to allow it, and refusing costs you no functionality whatsoever.
Browser storage
Rotevia does not use local storage or session storage at all. The four cookies above are the only thing it keeps on your device.
Changing your mind
You can change your choice at any time. Every page has a “Cookie settings” entry in its footer, and it opens the same panel as the button below. Turning analytics off reloads the page so that anything already loaded stops running immediately.
You can also clear or block cookies in your browser’s own settings. Doing so will sign you out and will make us ask about analytics again on your next visit.
Questions
Anything about cookies or the data behind them: hello@rotevia.co.uk. The wider picture is in the privacy policy.