1. Our approach
Google Analytics remains unloaded until you choose Allow analytics. Decline analytics keeps it off without limiting access to the website. You can change or withdraw your choice through Privacy choices in the footer. Withdrawal disables measurement and clears the website’s Analytics cookies.
Necessary storage cannot be disabled through a RiskRover preference panel without breaking the requested service. Blocking necessary cookies may prevent forms, authentication or saved preferences from working correctly.
Marketing email consent is handled separately through optional form fields. It is not a cookie preference.
2. Cookies and storage
Scroll sideways to read all columns. The first column stays visible.
| Name | Where | Purpose | Type and lifetime |
|---|---|---|---|
| riskrover_session (configured Laravel session cookie) | Public form/tool pages and application | Session state, authentication and CSRF protection | First-party HTTP-only cookie; 120 minutes by default, configurable by deployment |
| XSRF-TOKEN | Authenticated application | Allows the application to send a verified CSRF token with same-origin requests | First-party cookie; follows the session lifetime |
| locale | Authenticated application | Remembers the language selected by the user | First-party HTTP-only cookie; 1 year |
| riskrover.website-privacy.v1 | Public marketing content pages | Remembers your analytics choice, independently of marketing email consent | First-party localStorage; choice is valid for 180 days, or until changed or cleared |
| language | Authenticated application | Loads the selected interface language without waiting for the server | First-party localStorage; remains until changed or browser data is cleared |
| RiskRover interface preference keys | Authenticated application | Remembers navigation, collapsed sections, last-used project/product and integration form context | First-party localStorage; remains until changed, cleared or removed by the relevant feature |
| riskrover_testing_effort_tool_v2 | Public Test Case Calculator | Keeps product areas, risk choices, dates and capacity in the current browser tab | First-party sessionStorage; removed when the browser tab/session is closed or restarted |
| _ga | Eligible public marketing content pages | Distinguishes visitors for Google Analytics website measurement | First-party analytics cookie; default expiration up to 2 years |
| _ga_R81Q74E58B | Eligible public marketing content pages | Persists Google Analytics session state | First-party analytics cookie; default expiration up to 2 years |
3. What is stored locally
Application preference keys may contain internal numeric project or user identifiers, a last visited same-origin path, collapsed/open states and the last integration organisation, project or team values entered by that user. They are used only to restore the interface and are not sent to a marketing or analytics service.
Verified application preference names and patterns are flow-sidebar-collapsed, riskrover:last-active-project-id, riskrover:last-active-project-path, riskrover:last-active-product-id, azure-devops:last-used:*, jira:last-used:*, jira:last-used:zephyr-scale:*, exec-pra-links-v2-*, exec-test-config-*, riskrover:execution-planning-columns:v1:* and riskrover.execution.work-items.collapsed.v1.*.
The public Test Case Calculator keeps working inputs in sessionStorage in the browser tab. It sends the current calculation inputs to the same RiskRover origin when a result is requested, but those working inputs are not persisted with a website submission.
4. Google Analytics
After you allow analytics, Google Analytics 4 receives standard measurement data from eligible public marketing content pages, including page URL and title, referrer, language, screen resolution, browser and device information, session statistics, approximate location and pseudonymous cookie identifiers.
The tag is excluded from the authenticated application, Test Case Calculator, Checkout, Checkout status or completion, and thank-you flows. No custom analytics events or form-value tracking are implemented. Google Analytics may collect enhanced-measurement events when that provider-side property setting is enabled.
Google documents a default expiration of up to 2 years for _ga and _ga_<container-id>. Browser settings, deletion rules and Google Analytics configuration can shorten their effective lifetime.
Google Analytics cookie usage Google Analytics opt-out add-on
5. External video players
Video-library pages do not load YouTube or Vimeo players automatically. They show a local placeholder first. Selecting Load video is an explicit, one-time instruction to connect to the named provider; RiskRover does not store that choice.
After loading, the provider receives normal technical request information such as the visitor IP address and browser headers and may use its own cookies or storage. YouTube uses its privacy-enhanced youtube-nocookie.com embed domain and Vimeo is requested with its do-not-track parameter, but provider processing remains governed by that provider's policy.
6. Browser controls and questions
Your choice is remembered for 180 days when browser storage is available. If storage is unavailable, the choice applies to the current page only. Clearing it or reaching its expiry turns analytics off until you make a new choice. Most browsers also allow cookies and site storage to be inspected, blocked or cleared. Blocking Google Analytics cookies prevents or limits website measurement but should not prevent public content from loading. Blocking necessary cookies may prevent forms, authentication, security checks or saved preferences from working correctly.
Questions about this inventory can be sent to privacy@riskrover.io.
Read the Privacy Policy Google Analytics opt-out add-on Contact RiskRover privacy