Last updated: May 2026
Cookies are small text files a website asks your browser to store. They let the site recognize you across pages — for example, to keep you signed in — and they also let third-party services we rely on (like our payment processor) do their job. This page lists every cookie we set, plus the third-party cookies the site loads.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| ar_residency | Ally Renewal | Records the answer to the "where do you live?" gate that fronts our quote / inspection flows. If set to "WA", we load the quote tooling for you; if set to "other", we show the out-of-state message instead. | 1 year |
| sb-<project>-auth-token (and related sb-* cookies) | Ally Renewal (via Supabase Auth) | Keeps you signed in across pages and protects your session. Required for any logged-in area of the site. | Session / refresh cycle (cleared on sign-out) |
| kf_user_type | Ally Renewal | Caches your role for 24 hours to avoid repeated permission lookups on every navigation. HTTPOnly, Secure, SameSite=Lax. | 24 hours |
| kf_last_activity_sync | Ally Renewal | Throttles how often your "last active" timestamp is written to our database. HTTPOnly, Secure, SameSite=Lax. | 15 minutes |
| kf_imp_user | Ally Renewal (super-admin only) | Tracks an active super-admin impersonation session so server-rendered pages render in the impersonated user's context. | Session (cleared when impersonation ends or the browser is closed) |
| ar_visitor_id | Ally Renewal | An anonymous, HMAC-signed identifier we use to stitch together steps in the public job-application funnel before you create an account. It is not linked to your identity unless you submit an application. | 1 year |
By default, our public marketing pages, privacy / cookie / terms pages, and the out-of-state fallback load no third-party scripts. The vendors below only load when you've explicitly entered a flow that needs them.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| Google Maps cookies | Loaded only inside the instant-quote and inspection-booking flows, after you confirm Washington residency on the residency gate. Used for address autocomplete and the property-confirmation map. | Varies per provider | |
| __stripe_* family | Stripe | Loaded only on payment pages (e.g., /pay/<token>) when you are actively paying for a service. Used to process the payment and detect fraud. | Varies; see stripe.com/cookie-settings |
| _vercel_* family | Vercel Analytics | Anonymous page-view and performance telemetry. Loaded only on the signed-in employee workspace, never on customer-facing pages. | Varies; see vercel.com/legal |
Most browsers let you block or delete cookies in their settings. Blocking the session cookies above will sign you out and break parts of the site that need you to be signed in (your dashboard, applying for a job, paying for a job). Blocking analytics cookies is safe — the site will work the same; we just won't see the anonymous usage data.
For SMS-related opt-out, see the Privacy Policy.
Questions about this policy? Email info@allyrenewal.com.