Cookies, and your choice.
The public pages ask before setting anything that is not needed to run the site. The app, sign-in and every page near your credentials never load analytics or outside scripts, whatever you choose here.
Your choice
The cookie bar on the public pages has four switches. Only Necessary is on until you choose. Allow all, Allow selection and Reject all are equally easy, and you can change your mind any time with Cookie settings in the footer. If your browser sends Global Privacy Control, Marketing stays off. We never sell your data and never use it for ads or retargeting.
What each category sets
| Category | Who and why | Cookies or storage | How long |
|---|---|---|---|
| Necessary (always on) | DylrDev. Keeps you signed in, remembers a trusted device you asked for, remembers your cookie choice. | __Host-dylr_session, __Host-dylr_device, dylr_consent | Session up to 30 days. Device 30 days, only if you tick the box. Choice 12 months. |
| Preferences | DylrDev. Remembers your light or dark theme on this device. | dylr-theme (local storage, never sent to us) | Until you clear it. |
| Statistics | DylrDev first-party analytics: pages, where visitors came from, clicks on links and buttons, scroll depth. Google Analytics 4 with ad features off. Session replay through PostHog or Microsoft Clarity, with every input and anything marked private masked. Each vendor runs only if we have switched it on. | dylr_aid, _ga, _ga_*, ph_*, _clck, _clsk | Up to 13 months. Our event records are kept 25 months. |
| Marketing | LinkedIn Insight Tag, for which companies and job roles visit. No ad campaigns, no retargeting. Only if we have switched it on. | li_sugr, bcookie, lidc, UserMatchHistory (LinkedIn) | Up to 6 months. |
The necessary cookies for sign-in are first party, HttpOnly and Secure, so scripts cannot read them. The consent and analytics id cookies are first party and readable by our own page script, which is how it knows what you allowed.
Where nothing extra ever runs
- The app, sign-in, sign-up, password reset, invites and the staff console never load analytics, session replay or marketing tags. The only outside script there is Cloudflare Turnstile, a bot check on the sign-up, forgot password, resend code and invite forms. It sets no cookie.
- We never record what you type into a form, your credentials, MCP URLs, tokens or tool arguments.
- On sign-up we count two steps, landed and submitted, with no details and only if you allowed Statistics.
How to clear them
- From DylrDev: choose Reject all in Cookie settings to stop analytics and marketing and remove our analytics id. Sign out to remove the session cookie. Revoke trusted devices in Settings, Security.
- From your browser: open site settings for dylr.dev and clear cookies. You will be signed out and the cookie bar will ask again.
The full detail is in the privacy policy. Questions? ryan@dylr.dev.