Cookie Policy
Version: 1.3 Effective date: 18 August 2026
This Cookie Policy explains how Silkway Tech LLC uses cookies and similar browser storage on railbase.app and how Railbase self-hosted deployments may use cookies and local storage. It should be read together with our Privacy Policy.
1. What cookies and similar storage are
Cookies are small text values stored by your browser. Similar technologies include localStorage, sessionStorage, and browser-managed security state. We use these technologies for authentication, security, language selection, preferences, and embedded checkout flows.
We do not use third-party advertising cookies. Our first-party website analytics are cookieless and do not set tracking identifiers.
2. railbase.app cookies and storage
| Name or storage key | Type | Purpose | Typical duration |
|---|---|---|---|
sess |
Necessary, HttpOnly cookie | Keeps an Account user authenticated and is checked against a server-side session registry on every authenticated request. | Ends after 30 minutes without real user activity, after 30 days absolute, on Account/session revocation, or on sign-out |
rb_account |
Necessary preference cookie | Remembers which accepted billing account a team member selected; every request revalidates membership. | Up to 1 year, or until cleared |
lang |
Preference cookie | Remembers selected site language for redirects and future visits. | Up to 1 year |
theme |
Preference localStorage | Remembers light/dark theme. | Until changed or cleared |
| Stripe.js / Stripe iframe storage | Necessary third-party payment storage | Enables secure payment collection, fraud prevention, and checkout/payment processing by Stripe. | Controlled by Stripe |
Session cookies use HttpOnly, SameSite, and production Secure attributes as applicable. Account pages send private/no-store cache directives. The browser reports only real interaction through a throttled activity endpoint; a quiet open tab does not keep the session alive, and history/back-forward restoration revalidates the session. Preference storage is readable by the page because the interface needs it.
railbase.app does not expose a browser-based operator console and does not set an operator cookie. Railbase Cockpit authenticates through the dedicated Operator API. Its short-lived access token remains in process memory, while the revocable refresh credential is stored in the operating system keychain rather than website cookies or localStorage.
3. Cookieless analytics
railbase.app records first-party analytics without analytics cookies. We may record page views, download events, referrer host, browser/user-agent, country derived from IP, a salted hash of IP address, dwell time, scroll depth, CTA clicks, basic performance signals, JavaScript error metadata, and bot/AI crawler classification. These analytics do not set a cookie or localStorage tracking ID and are used for security, reliability, Product improvement, and distribution reporting.
Optional network export verification, when enabled, also does not set a cookie or persistent browser identifier. It evaluates the request IP at request time as described in the Privacy Policy; the export assessment ledger stores a salted IP hash and derived location/privacy signals, not the raw IP.
4. Self-hosted Railbase cookies and storage
If you run Railbase on your own server, your deployment may set cookies and local storage values such as:
| Name or storage key | Type | Purpose |
|---|---|---|
railbase_session |
Necessary cookie | Authenticates app users in the self-hosted deployment. |
railbase_admin_session |
Necessary cookie | Authenticates system admins in the self-hosted admin console. |
railbase_csrf |
Necessary security cookie | Double-submit CSRF protection for cookie-authenticated requests. This cookie must be readable by the SPA so it can mirror the value into the X-CSRF-Token header. |
railbase_oauth_state |
Necessary security cookie | Protects OAuth/OIDC sign-in flow state, including provider, nonce, return URL, and PKCE verifier where applicable. |
railbase_saml_state |
Necessary security cookie | Protects SAML sign-in flow state and request binding. |
rb_token, rb_tenant_id or similar |
Local storage | Used by site-user and Component frontends to attach the app-user bearer token and selected company (X-Tenant) to API calls. |
| Admin authentication storage | Cookie or browser storage, depending on build | Authenticates the separate /_/ administrator audience; it is not accepted as a site-user credential on /api/*. |
| UI preference keys | Local storage or cookies | Theme, language, sidebar state, or similar interface preferences. |
Your organization is responsible for disclosing and managing cookies, localStorage, analytics, consent, and third-party scripts in your own self-hosted deployment and any applications you build with Railbase.
5. Component storage
Components reuse Railbase site-user identity and company selection unless their documentation identifies an additional necessary key. Their declared UI is delivered inside the signed encrypted Component bundle and mounted by the site shell; Component business data is normally stored server-side in the Customer's Vault, not in browser cookies.
6. Consent
We currently use cookies and similar storage that are necessary for authentication, security, checkout, language selection, and preferences. Because our analytics do not use cookies or persistent browser tracking identifiers, we do not currently display an analytics-cookie consent banner. If we add non-essential cookies, advertising cookies, or cookie-based analytics, we will update this policy and request consent where required.
7. Managing cookies
You can block or delete cookies and localStorage in your browser settings. Blocking necessary cookies may prevent sign-in, checkout, CSRF protection, OAuth/SAML sign-in, admin access, or language/theme preferences from working correctly.
8. Contact
Questions about cookies or privacy can be sent to support@railbase.app.