Cookie Policy
This Cookie Policy explains how Buildrok ("Buildrok", "we", "us") uses cookies and similar browser-storage technologies when you visit buildrok.com and use our Service. It lists every cookie and storage key we set, by name. For more information about how we handle your personal data generally, see our Privacy Policy.
What are cookies?
Cookies are small text files that a website stores on your device and that your browser sends back to that website with each request. Browsers also offer localStorage, which keeps data on your device until it is cleared, and sessionStorage, which keeps it until you close the tab. Neither of those is sent to a server by itself. Privacy laws in some places, including the European Union and the United Kingdom, treat all three the same way, so this policy covers all three.
The short version
- We do not use advertising cookies, tracking pixels, retargeting, or cross-site tracking of any kind.
- Our marketing pages set no cookies. Every cookie buildrok.com sets is strictly necessary: it keeps you signed in, ties a draft you started without an account to your browser, or protects a sign-in or account connection while it is in progress.
- One thing on our own pages is analytics rather than strictly necessary: PostHog's identifier, kept in localStorage on our marketing pages. It is not a cookie, but the laws mentioned above treat it like one. We do not load PostHog at all when your browser sends a Global Privacy Control or Do Not Track signal, and you can clear the identifier at any time.
- Everything else in browser storage remembers something you chose in our interface, such as dark mode or a tip you dismissed.
Cookies
Cookies set by buildrok.com. Strictly necessary
| Name | Purpose | Duration |
|---|---|---|
brk_sess | Tells our server which account is signed in, so pages can be drawn for you. It is signed and HTTP-only (scripts cannot read it), and it is never accepted on its own as permission to read or change your data. | 30 days, or until you sign out |
brk_anon | Set when you start a site before creating an account. It ties that draft to the browser that started it, so nobody else can edit it. It holds a random value, not your identity, and is HTTP-only. | 30 days |
ig_oauth_nonce, ig_oauth_return | Set when you connect an Instagram account, to check that the reply comes from the connection you started and to bring you back to the page you were on. HTTP-only. | 10 minutes, deleted when the connection finishes |
gbp_oauth_nonce, gbp_oauth_return | The same, for connecting a Google Business Profile. HTTP-only. | 10 minutes, deleted when the connection finishes |
Sign-in cookies (Neon Auth). Strictly necessary
Our sign-in provider, Neon Auth (Neon, Inc.), sets cookies whose names begin with
__Secure-neon-auth when you sign up or sign in, whether with email and password or with
Google. They hold your sign-in session with Neon Auth and live on Neon Auth's own domain, not on
buildrok.com. During a Google sign-in it also sets __Secure-neon-auth.session_challenge,
which lasts 10 minutes and secures the redirect back to us.
A few account requests, such as resetting your password, pass through buildrok.com/api/auth on their way to Neon Auth. When they do, the same cookies are set on buildrok.com instead. None of them is used for tracking or advertising.
Cookies set only on Buildrok staff browsers
| Name | Purpose | Duration |
|---|---|---|
brk_imp | Identifies an active support session while authorized staff act on an account, as described in section 3.4 of our Privacy Policy. Signed and HTTP-only. | 30 minutes |
brk_build | Lets a staff member edit the one site they are building for a Done-For-You order, and nothing else in that account. Signed and HTTP-only. | 8 hours |
Neither of these is ever set on a customer's browser.
Browser storage
Keeping you signed in (localStorage). Strictly necessary
| Name | Purpose | Duration |
|---|---|---|
brk_auth_token | Your sign-in token (a JSON Web Token), so you stay signed in from one page to the next. | Until you sign out or clear browser storage |
brk_auth_email | Your email address, shown in the menu while you are signed in. | Until you sign out or clear browser storage |
brk_sess_minted_at | When the brk_sess cookie was last renewed, so it is not renewed on every page. | Until you clear browser storage |
Preferences and interface state (localStorage). Functional
These remember something you chose. They stay until you clear your browser storage.
| Name | What it remembers |
|---|---|
theme | Light or dark mode, so the next page loads in the right one without a flash. |
brk_display_name, brk_avatar_color, brk_role | Your name, avatar color and account type, so the menu can be drawn before our server answers. Your account type only decides which links are shown; our server checks your permissions on every request. |
brk_acct_tab | The tab you last opened on your Account page. |
brk_bookings_last_slug, brk_lead_alerts_last_slug,
brk_receptionist_last_slug, brk_ai_receptionist_last | Which site or receptionist you last looked at, so the page reopens on it. |
brk_setup_draft | The draft your setup questions are filling in, so a reload carries on where you were. |
brk_preview_viewport, brk_editmode, brk_editmode_optin,
brk_sections_open | How you like the editor laid out: the preview size, the editing mode and whether the sections panel is open. |
brk_recent_fonts | Fonts you picked recently in the editor. |
brk_mobile_tip_seen, brk_edit_hint_seen,
brk_edit_mode_hint_shown, brk_pulse_seen, brk_onboarded_v4,
brk_hint_* | Editor tips and the welcome tour you have already seen or dismissed. |
brk_reveal_later | That you chose to see your page before finishing its content. |
brk_dfy_nudge_dismissed:* | That you dismissed the Done-For-You suggestion in the editor. It shows again after 7 days. |
stk-touched:*, stk-looks-done:* | Your progress in the section-order builder. |
brk-checklist:* | The boxes you ticked on a checklist in one of our blog posts. |
A * stands for the draft, site or page the entry belongs to.
For the current tab only (sessionStorage). Functional
These are cleared when you close the tab.
| Name | What it holds |
|---|---|
brk_undo_* | The editor's undo and redo history for a draft. |
stk-carry:* | Changes in the section-order builder that have not been saved yet. |
brk_flash_pending, brk_update_success_toast | A confirmation message to show once the page has reloaded. |
brk_scroll_restore, brk_scroll_target, brk_dfy_scroll | Where to scroll back to after a page reloads. |
brk_preview_sb_tab | Which editor sidebar tab is open. |
brk_readiness_celebrated_*, brk-anim-hint,
brk_onboarding_dismissed | Editor messages already shown or dismissed in this tab. |
Analytics on our marketing pages. Not strictly necessary
On our own marketing pages at buildrok.com (not on the websites you publish), we use two analytics tools to see which pages are viewed and how visitors move through signup, so we can improve the product. Neither sets a cookie, and neither is used for cross-site tracking or advertising.
| Tool | Stored on your device | Purpose | Duration |
|---|---|---|---|
| PostHog (PostHog, Inc.) | localStorage: ph_<project key>_posthog. sessionStorage, for the current
visit: ph_<project key>_posthog, _window_id,
_primary_window_exists and _session_registered_properties. | Page views and the steps of our signup flow. We switch off PostHog's session recording, automatic click capture and heatmaps, and it does not keep your IP address. | localStorage until you clear it; sessionStorage until you close the tab |
| Vercel Web Analytics (Vercel, Inc.) | Nothing | Counts of page views and page speed for our marketing pages. | Not stored on your device |
Global Privacy Control and Do Not Track. When your browser sends a Global Privacy Control signal or a Do Not Track signal, our pages load neither tool, and we drop the product-step records described in our Privacy Policy that your browser would otherwise send. Three steps are recorded by our server at the moment they happen, whatever your browser sends: a draft being created, a site being published and a custom domain going live. Product-step records come from our own pages only, including your dashboard and the editor, and store nothing on your device.
Error monitoring in the app and editor
On your dashboard and in the editor (not on our marketing pages), our error-monitoring provider,
Sentry (Functional Software, Inc.), reports errors so we can fix them. It also records a replay of a
sample of sessions and of any session that hits an error, with every piece of text masked, every form
input masked and every image and video blocked, so nothing you type or upload is in it. It keeps the
state of that replay in sessionStorage under sentryReplaySession, cleared when you close
the tab.
Bot protection
Our signup, business-search and demo pages, and the editor's option to email yourself a link, use Cloudflare Turnstile to tell people from bots. It runs in a frame served by Cloudflare under Cloudflare's own privacy policy and stores nothing on buildrok.com.
Browser storage used only by Buildrok staff
brk:annotate:pending (localStorage) holds feedback notes a staff member has written but
not yet sent, and brk_gate_tried (sessionStorage) stops our admin pages from retrying a
failed sign-in check in a loop. Neither is written on a customer's browser.
What we do not use
- Google Analytics, Meta, or any advertising-network analytics on our own pages
- Advertising or retargeting cookies
- Social media tracking pixels (Meta Pixel and similar)
- Session recording for analytics or advertising. The only replay is Sentry's masked error replay described above.
- Third-party chat widgets that set their own cookies
Websites published with Buildrok
This policy covers buildrok.com. A website you publish through Buildrok belongs to you, and what it stores on your visitors' devices depends on what you add to it.
- Our page-view counter stores nothing. We count page views for your dashboard without cookies or any other storage: a daily-rotating SHA-256 hash of the visitor's IP address and browser counts approximate unique daily visitors, and the raw IP address is not stored.
- Analytics you add are yours. If you add Google Analytics or a Meta Pixel in your
site settings, those tools set their own cookies under their own policies. Unless you switch it off,
your site then shows a consent banner: until a visitor accepts, Google Analytics runs in Google's
consent mode without storing anything and the Meta Pixel does not start. The visitor's choice is
kept in localStorage as
brk_consent. Plausible and Fathom do not use cookies and load without a banner. An analytics tag you paste into your site's settings (we accept known analytics tags only) runs under its provider's rules. - Two small flags. When a visitor closes your site's promotion bar, or the
cottage-food disclosure on a cottage-food site, sessionStorage remembers it for that tab
(
brk_promo_dismissed_v1,brk_cottage_disclosure_dismissed). - Embeds follow their provider's rules. A booking widget, map or video you add is served by its provider, who may set its own cookies.
How to control cookies and browser storage
You can clear cookies, localStorage and sessionStorage at any time in your browser settings. Clearing them signs you out of Buildrok and resets the preferences listed above. Most browsers also let you:
- Block all cookies, or only third-party cookies
- Delete all cookies and site data for one site
- Browse in a private window, which discards most storage when the window closes
Blocking the strictly necessary cookies and storage above stops you from staying signed in. To opt out of our analytics without clearing anything, turn on Global Privacy Control in your browser.
Changes to this policy
We may update this Cookie Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Material changes will be notified via a notice on the Service or by email.
Contact
Questions about this Cookie Policy?
- Email: support@buildrok.com
- Contact form: buildrok.com/contact
- Mailing address: Buildrok LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States