Cookie Policy

1. What this page covers

Cookies are small files a website saves in your browser so it can remember things between page loads. Browsers also give sites two other places to keep information — local storage and session storage — and RoofStruct uses those far more than it uses cookies. Some of this is set by RoofStruct directly (first-party) and some by services we use (third-party). Clearing “cookies and site data” in your browser clears both kinds, which is why doing so signs you out.

2. What RoofStruct itself stores

RoofStruct's own code sets exactly one cookie: a language cookie. Everything else we store is kept in your browser's local or session storage rather than in a cookie — including your sign-in session.

• Your sign-in session. Stored in your browser's local storage by our authentication library, not in a cookie. Clearing site data signs you out, and you sign in again.
• Language. The one cookie we set is rs_lang, kept for a year and cleared when you sign out, alongside preferred_language in local storage. Together these keep the site in French or Spanish between visits if you switch from the default.
• Interface preferences. Things like theme, sidebar state, hints and tips you have dismissed, the last image-enhancement option you chose, and short-lived markers used to recover from a stale page load. These stay in your browser.
• How you found us. The first time you arrive, we note the campaign labels on the link you followed (for example, which ad or newsletter), the click identifier an ad platform adds to that link, the page you landed on, the site that sent you, whether you were on a phone, tablet or computer, and when. It is kept in local storage under rs_attribution for 30 days, saved to your account if you sign up, and copied onto the orders you place, so we can tell which ads and links bring customers. We keep the page, never the rest of the address; the referring site's name, never the full link. This note does not depend on the advertising switch, because nothing in it is sent to an ad platform: the only identifiers that go to Meta are the two cookies in section 5, and only while advertising is on.

3. Analytics: what loads, and when

Google Analytics 4 loads on every page as soon as you arrive, before you interact with the site, for every visitor. Outside the United States a short notice on your first visit points you to your options; in the United States no notice is shown, and the Cookie Preferences link in our site footer is where you change it. Neither is a consent gate: analytics is already running when you arrive, and it does not wait for you to choose. It sets cookies in your browser whose names begin with _ga. Google receives your IP address, from which it derives an approximate location; the pages you visit; and, once you are signed in, a stable identifier for your RoofStruct account together with page addresses that can contain internal identifiers for your workspace, projects and orders. Ad storage, ad user data and ad personalisation are all set to denied on our Google Analytics property, and we do not use Google Analytics for advertising, retargeting or audience building. Advertising is a separate purpose, with its own tag and its own switch — section 5 covers it.

One honest note for readers in the EEA and the UK: a notice you can dismiss is not the same as the prior opt-in those rules apply to analytics cookies, and we are not claiming it is. What we do give you is an opt-out that works immediately, described in the next section.

4. Your controls — and what we don't have

You can turn analytics off at any time from the Cookie Preferences link in our site footer, from the button just below, or from the first-visit notice where one is shown. Cookie Preferences also carries a separate switch for advertising. Turning analytics off stops it for this browser and deletes the analytics cookies already stored here; turning advertising off stops the Meta pixel and deletes its cookies. Your choices are remembered in this browser only — if you use another device or clear site data, set them again.

We also honour Global Privacy Control. If your browser or an extension sends a GPC signal, we treat it as an opt-out of both analytics and advertising before either loads at all — no tag, no cookie, no request — and you will not see the notice. We do not act on Do Not Track, which GPC has effectively replaced.

Outside RoofStruct, you can also block or clear cookies and site data for this site in your browser settings (Chrome, Safari, Firefox and Edge all support this), install Google's own opt-out browser add-on, or use any tracker-blocking extension. RoofStruct works with analytics and advertising blocked. If you clear site data you will be signed out, and your language, theme and cookie choices will reset to the defaults. What we still do not have is a per-vendor consent manager — there are two non-essential purposes here, analytics and advertising, and each has its own control. Google's opt-out add-on is available here.

5. Advertising: the Meta pixel

RoofStruct advertises on Facebook and Instagram, and on Google Search. Our Google ads load nothing on this site: no tag, no pixel, no cookie. That is why this section is about Meta. We measure our Facebook and Instagram ads with the Meta Pixel and Meta's Conversions API. When advertising is on for your browser, a script from Meta loads on our pages and sets two cookies — _fbp, an identifier for this browser, and _fbc, which records the ad click that brought you here. Meta receives the pages you view on our site, and the fact that you created an account or paid for an order. The same events are also sent from our servers with a shared event identifier so Meta counts one conversion rather than two, and that server copy is sent only when advertising is on for your browser.

What reaches Meta is your IP address, the page addresses, and identifiers we hash before they leave our servers so Meta can match an event to an account without receiving the underlying address. We do not send Meta your customers' names, addresses or measurements, and we do not upload contact lists to any ad platform.

Where you are decides the default. In the United States advertising is on when you arrive, no notice is shown, and the switch behind the Cookie Preferences link in our site footer turns it off. In Canada, Québec, the EEA, the UK and everywhere else — including anywhere we cannot tell — it stays off until you turn it on. We read your browser's own time zone to make that call; nothing is sent anywhere to work it out. For visitors we treat as being in the United States we also set Meta's Limited Data Use flag, which tells Meta to handle the event under the restricted regime some US state laws require.

Global Privacy Control wins over all of it: if your browser sends a GPC signal, advertising stays off whatever is stored here, and the Meta script never loads. Turning advertising off also deletes the _fbp and _fbc cookies already in this browser. You can change your choice at any time from the button in section 4 above, or from the Cookie Preferences link in our site footer.

6. Cookies set by other companies

Some pages load code from other companies, and those companies set their own cookies. We do not control them and cannot list them exhaustively; their own policies apply. Google Analytics is covered in section 3 above and the Meta pixel in section 5.

Lemon Squeezy. Our checkout script loads on the pricing and billing pages and opens the payment overlay from their domain. They set cookies to process the payment securely — see their site for details.

Bot detection. Where it is enabled, the automated-submission check on our public forms is loaded from a third-party bot-detection service, which receives your IP address.

7. What we don't use

We advertise on Facebook and Instagram, and on Google Search. The only advertising technology on this site is the Meta pixel described in section 5: our Google ads load no tag, pixel or cookie here. We do not use social-media tracking widgets other than that pixel, session-replay recording, or fingerprinting scripts. Session replay is explicitly disabled in our error monitoring. We do not sell visitor data for money and we do not upload customer lists to any advertising platform — but several US state laws treat an advertising pixel as a “share”, which is why advertising has its own switch here and a “Do Not Sell or Share My Personal Information” control on our Privacy Policy.

8. Changes to this page

If we add or remove a category, or build a control we do not have today, we will update this page with a fresh “Last Updated” date. For material changes we will also give notice by email or in the dashboard to people who have an account, matching what our Privacy Policy says.

9. Contact

Questions about cookies or anything else we store in your browser — email . Our Privacy Policy has the fuller list of who receives information about you.