Cookie Policy

An honest list of every cookie, localStorage entry, and similar storage technology used by signalgate.ai and the customer dashboard.

Last updated: 2026-10-15Effective: 2026-06-30

1. Scope

This Cookie Policy describes the cookies and similar technologies that SignalGate uses on signalgate.ai (the marketing site) and on the customer dashboard. It is part of and should be read alongside our Privacy Policy.

2. What we mean by 'cookies'

The term "cookies" in this policy covers any technology that stores information in your browser, including:

  • HTTP cookies (set via the Set-Cookie header)
  • localStorage and sessionStorage entries
  • IndexedDB or other client-side persistence

3. Categories we use

We use three categories of storage:

  • Strictly necessary — the authentication tokens that make the dashboard work (listed in section 4).
  • Advertising measurement — a Google Ads conversion tag (Google LLC) and the X conversion tracking pixel (X Corp.), which measure whether visits arriving from our ads lead to sign-ups.
  • Analytics — Yandex Metrica (Yandex), which collects product-usage analytics including clickmaps and Webvisor session replay (recordings of page interactions).

We still do not use a Facebook pixel, and we do not buy or sell data from data brokers. You can block or clear any of this storage at any time — see section 6.

4. The actual list

Everything currently set in your browser when you use SignalGate:

NameTypePurposeLifetime
signalgate_tokenlocalStorageShort-lived JWT used to authenticate dashboard API requests. Without it the dashboard cannot work.15 minutes (rotated)
signalgate_refresh_tokenlocalStorageLonger-lived JWT used to refresh the access token without forcing you to sign in again on every visit.7 days (rotated on use)
_gcl_*HTTP cookieGoogle Ads conversion attribution (Google LLC). Records that you arrived via a Google ad (the gclid URL parameter) so a later sign-up can be attributed to the ad campaign. Loads across the whole site.Typically ~90 days (set by Google)
_ym_uid, _ym_d and related _ym_*HTTP cookieYandex Metrica (Yandex) — product analytics, clickmap, and Webvisor session replay (recordings of page interactions). Loads on public pages only — not inside the signed-in dashboard.Up to 1 year (set by Yandex)
_twclid, _twpid, _twsidHTTP cookieX conversion tracking pixel (X Corp.). Records that you arrived via an ad on X (the twclid URL parameter) so a later sign-up can be attributed to the ad campaign; _twsidholds X's session identifier for that measurement. Loads on public pages only; opening the signed-in dashboard does not load it.Up to about 13 months (set by X)
Server-set session cookiesHTTP cookieNone at present. We use bearer-token auth, not session cookies. This row is here to confirm that.—

Source of truth: the SignalGate keys above are set by src/lib/api.ts in the frontend repo; the _gcl_*, _ym_* and _twclid / _twpid / _twsidcookies are set by the Google, Yandex and X scripts. You can verify by inspecting the "Application → Storage" tab in your browser's DevTools.

5. Third-party cookies

signalgate.ai loads three third-party scripts that set cookies:

  • Google Ads conversion tag (Google LLC) — ad-conversion measurement. Sets _gcl_* cookies and reads the gclid URL parameter.
  • Yandex Metrica (Yandex) — product analytics, clickmap, and Webvisor session replay. Sets _ym_* cookies.
  • X conversion tracking pixel (X Corp.; Twitter International Unlimited Company for the EU, UK and EFTA) — ad-conversion measurement, on public pages only. Sets _twclid, _twpid and _twsid cookies and reads the twclidURL parameter. To stop X from using this data to personalise the ads you see, use X's privacy controls for personalised ads.

Beyond those three: no Facebook pixel, no other advertising networks, and no data brokers. If we add another third-party tool in future (for example, a customer-support chat widget), it will be listed here.

One exception worth flagging: when you use the customer dashboard, the SignalGate fingerprint SDK (the same SDK our customers integrate into their sites) is loaded from our CDN and runs locally in your browser. It does not set cookies and does not transmit data unless you submit the sign-in or sign-up form, at which point the encrypted fingerprint payload is sent to our API. See the Privacy Policy for details on what we do with it.

6. How to manage cookies

You can clear or block any of the storage above through your browser settings. Browser instructions:

Note: clearing signalgate_token / signalgate_refresh_token will sign you out of the dashboard. You can re-sign-in afterwards.

7. Changes

We will update this policy whenever we add or remove a stored value. The "Last updated" date at the top of this page reflects the current edition.

8. Contact

Questions about cookies or this policy: [email protected].