01What cookies and similar tools do
Cookies are small values stored by a browser. Similar technologies include local storage, session storage, and browser or request signals. We use them only where they are necessary to keep the site secure, remember a user preference, support authentication, or measure product reliability and usage when analytics is enabled.
02What Rule & Form uses
- Essential session and security storage: the application may use secure cookies to maintain an authenticated session and protect account requests.
- Preference storage: the marketing shell may use browser storage for presentation preferences such as theme state.
- Turnstile signals: Cloudflare Turnstile may run browser challenges on authentication and public customer lead-form surfaces to distinguish people from automated abuse. Cloudflare says Turnstile processes signals necessary for that security function and does not access or transmit form entries. Cloudflare may independently process Turnstile signals as a controller under its own privacy terms.
- Optional server analytics: when configured, Rule & Form sends coarse product events to PostHog from the server. The event contract is designed not to include lead message bodies or contact details.
03What we do not use
Rule & Form does not intentionally install third-party advertising cookies, sell personal information, or use cross-site behavioral advertising. If that changes, we will update this policy and add any required choice mechanism before enabling the new use.
04Your choices
You can clear cookies or local storage through your browser settings, block nonessential storage, or use a private browsing mode. Blocking essential session or security storage may prevent sign-in or protected requests from working. If an analytics choice control is added to a product surface, it will be described there.
05California Do Not Track disclosure
California’s online privacy rules ask commercial websites to explain how they respond to browser Do Not Track (DNT) signals and whether other parties may collect information about activity across sites. Rule & Form does not currently change its collection practices in response to a DNT signal. We also do not currently use cross-site behavioral advertising or intentionally track visitors across unrelated sites. Cloudflare may receive security signals when Turnstile is enabled, as described above and in Cloudflare’s own privacy terms.
06Third-party information
Third parties may process their own signals under their own policies. See Cloudflare’s Turnstile Privacy Addendum for Turnstile-specific details and our Privacy Policy for the broader Rule & Form data practices.
07Contact
Questions about browser storage or privacy: hello@ruleandform.com.