1. Scope
This Cookie Policy describes the cookies and similar technologies that SignalGate uses on signalgate.ai (the marketing site) and on the customer dashboard. It is part of and should be read alongside our Privacy Policy.
2. What we mean by 'cookies'
The term "cookies" in this policy covers any technology that stores information in your browser, including:
- HTTP cookies (set via the
Set-Cookieheader) localStorageandsessionStorageentries- IndexedDB or other client-side persistence
3. Categories we use
We use three categories of storage:
- Strictly necessary — the authentication tokens that make the dashboard work (listed in section 4).
- Advertising measurement — a Google Ads conversion tag (Google LLC) that measures whether visits arriving from our ads lead to sign-ups.
- Analytics — Yandex Metrica (Yandex), which collects product-usage analytics including clickmaps and Webvisor session replay (recordings of page interactions).
We still do not use a Facebook pixel, and we do not buy or sell data from data brokers. You can block or clear any of this storage at any time — see section 6.
4. The actual list
Everything currently set in your browser when you use SignalGate:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| signalgate_token | localStorage | Short-lived JWT used to authenticate dashboard API requests. Without it the dashboard cannot work. | 15 minutes (rotated) |
| signalgate_refresh_token | localStorage | Longer-lived JWT used to refresh the access token without forcing you to sign in again on every visit. | 7 days (rotated on use) |
| _gcl_* | HTTP cookie | Google Ads conversion attribution (Google LLC). Records that you arrived via a Google ad (the gclid URL parameter) so a later sign-up can be attributed to the ad campaign. Loads across the whole site. | Typically ~90 days (set by Google) |
| _ym_uid, _ym_d and related _ym_* | HTTP cookie | Yandex Metrica (Yandex) — product analytics, clickmap, and Webvisor session replay (recordings of page interactions). Loads on public pages only — not inside the signed-in dashboard. | Up to 1 year (set by Yandex) |
| Server-set session cookies | HTTP cookie | None at present. We use bearer-token auth, not session cookies. This row is here to confirm that. | — |
Source of truth: the SignalGate keys above are set by src/lib/api.ts in the frontend repo; the _gcl_* and _ym_*cookies are set by the Google and Yandex scripts. You can verify by inspecting the "Application → Storage" tab in your browser's DevTools.
5. Third-party cookies
signalgate.ai loads two third-party scripts that set cookies, on both the marketing site and the dashboard:
- Google Ads conversion tag (Google LLC) — ad-conversion measurement. Sets
_gcl_*cookies and reads thegclidURL parameter. - Yandex Metrica (Yandex) — product analytics, clickmap, and Webvisor session replay. Sets
_ym_*cookies.
Beyond those two: no Facebook pixel, no other advertising networks, and no data brokers. If we add another third-party tool in future (for example, a customer-support chat widget), it will be listed here.
One exception worth flagging: when you use the customer dashboard, the SignalGate fingerprint SDK (the same SDK our customers integrate into their sites) is loaded from our CDN and runs locally in your browser. It does not set cookies and does not transmit data unless you submit the sign-in or sign-up form, at which point the encrypted fingerprint payload is sent to our API. See the Privacy Policy for details on what we do with it.
6. How to manage cookies
7. Changes
We will update this policy whenever we add or remove a stored value. The "Last updated" date at the top of this page reflects the current edition.
8. Contact
Questions about cookies or this policy: [email protected].