This Cookie Policy explains how SkyRaileon LLC (“Raileon,” “we,” “our,” or “us”) uses cookies and similar technologies on our website at raileon.com and in the Raileon platform. It sits alongside our Privacy Policy, which covers everything else we do with your data.
1. What cookies are
A cookie is a small text file that a website asks your browser to store and send back on later visits. Cookies are how a site remembers that the request it just received came from the same browser as the last one, which is what makes staying signed in possible.
“Similar technologies” means anything that reads or writes data in your browser for the same purpose, such as local storage, session storage, and pixels. We describe those in Section 3.
How cookies are categorized
- Strictly necessary: the site cannot deliver the service you asked for without them. Signing in is the clearest example. Under GDPR and the ePrivacy rules these do not require consent.
- Functional: remembers a preference you set. Useful, but the site still works if it is missing.
- Analytics: measures how the site is used. Our own analytics sets no cookies; Google Analytics and Microsoft Clarity on our public pages set their own (Sections 2 and 3).
- Advertising: measures whether ads work, and lets an advertiser show its ads to people who visited its site. Our public pages use these from Google Ads, Meta and Microsoft (Section 3), and you can turn them off (Section 5).
2. Every cookie we set
Rather than a fixed list that goes stale the moment our authentication provider changes something internally, the table below is organized by purpose, with a catch-all row for any cookie that serves the same purpose under a name we have not spelled out individually. If you inspect your browser and find a cookie on a Raileon domain that does not fit any purpose described below, we want to know about it. Email privacy@raileon.com.
| Cookie | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
__session | Clerk (our authentication provider) | Holds your signed session token so the platform knows who you are on each request. | Strictly necessary | Refreshed continuously while you are signed in; cleared when you sign out. |
__client_uat | Clerk (our authentication provider) | Records when your session was last updated so pages can tell whether you are signed in before the session token is read. | Strictly necessary | Persists while you remain signed in; reset when you sign out. |
__client_uat_<instance suffix>e.g. __client_uat_w4nuQUPX | Clerk (our authentication provider) | The same purpose as __client_uat above, scoped to our specific Clerk application instance. Clerk sets this even when you are signed out, so it can tell whether the browser has an active session anywhere on the site without reading the session token itself. | Strictly necessary | Persists while you remain signed in; reset when you sign out. |
raileon_impersonation | Raileon | Marks a support session in which an authorized Raileon staff member is viewing your workspace to help with a request. Only ever set on the staff member's browser, never on yours. | Strictly necessary | 10 minutes |
sidebar_state | Raileon | Remembers whether you left the dashboard sidebar expanded or collapsed. Set only after you sign in. | Functional preference | 7 days |
rai_ref | Raileon | Remembers which Raileon partner referred you, so they are credited if you later book a call. Set only when you arrive through a partner's link; the first partner's link wins. | Functional preference | 90 days |
rai_vid | Raileon | A random visitor ID, stored with the record of a visit from a partner's link and sent with a booking request or partner sign-up, so we can check that referral credit is genuine. It holds no personal information. Set only when you arrive through a partner's link. A short-lived marker (rai_ref_new, 10 minutes) is set alongside the first time, so that visit is counted once. | Functional preference | 1 year |
googtrans | Google Translate (only after you pick a language at the bottom of a page) | Remembers the language you picked | Functional preference | 1 year |
_gcl_au, and _gcl_aw after a click on one of our ads | Google Ads (our public pages only) | Advertising measurement (Section 3) | Advertising | About 90 days |
_fbp, and _fbc after a click on one of our ads | Meta (our public pages only) | Advertising measurement (Section 3) | Advertising | About 90 days |
_uetsid | Microsoft Advertising (our public pages only) | Advertising measurement (Section 3) | Advertising | 1 day |
_uetvid | Microsoft Advertising (our public pages only) | Advertising measurement (Section 3) | Advertising | About 13 months |
_uetmsclkid, after a click on one of our ads | Microsoft Advertising (our public pages only) | Advertising measurement (Section 3) | Advertising | About 90 days |
_ga | Google Analytics (our public pages only) | Tells one browser from another (Section 3) | Analytics | 2 years |
_ga_<ID> | Google Analytics (our public pages only) | Keeps the current session together | Analytics | 2 years |
_clck | Microsoft Clarity (our public pages only) | Remembers the Clarity user ID and settings (Section 3) | Analytics | 1 year |
_clsk | Microsoft Clarity (our public pages only) | Joins page views into one recording | Analytics | 1 day |
CLID | Microsoft Clarity (our public pages only) | Notes the first time Clarity saw this browser | Analytics | 1 year |
MUID | Microsoft (with Clarity, our public pages only) | Identifies a browser across Microsoft sites | Analytics | 1 year |
| Turnstile storage | Cloudflare (bot check on our inquiry form, loaded only when you open the form) | Tells people from automated traffic before an inquiry is accepted. Cloudflare Turnstile reads browser and connection signals, and may store a short-lived token or identifier in your browser to run the check. We do not control what Cloudflare stores; see Cloudflare's privacy policy. | Strictly necessary (abuse prevention); only if you open the form | Set and controlled by Cloudflare, not by us. |
| TradingView storage | TradingView (third-party embed, loaded only after you click “Load market chart” on a market chart inside the dashboard) | Once loaded, the embedded chart may set its own cookies or browser storage inside its frame to run the charting widget. We do not control what TradingView stores; see TradingView's own policies. | Third-party embed (load-on-click, not set by default) | Set and controlled by TradingView, not by us. |
Any other Clerk cookie prefixed __client or __session | Clerk (our authentication provider) | Catch-all: Clerk periodically mints additional instance-suffixed variants of its own authentication cookies as its SDK is upgraded. Any cookie in this family serves the same strictly-necessary sign-in purpose as the named rows above, whether or not we have listed its exact current name. | Strictly necessary | Persists while you remain signed in; reset when you sign out. |
None of these cookies contain your business content, and none of them are readable by any other website. The advertising tags send their cookies' values to Google, Meta and Microsoft, which may also use cookies on their own domains (such as google.com, facebook.com or bing.com) under their own privacy policies.
3. What we do not do
We want to be specific rather than reassuring, so here is the advertising we do use, followed by the things that are simply absent:
- Advertising measurement. We use tags from Google Ads, Meta (Facebook and Instagram) and Microsoft Advertising to count whether our ads lead to booked calls, and to show our ads to people who visited our site. We don't sell your information for money.
- Form details sent to Google Ads. When you submit a form on our public pages, the Google Ads tag may send Google a hashed version of the email address, phone number or address you typed. Google uses it to match a booked call to the ad that led to it and to show you relevant ads. Google calls this user-provided data, or enhanced conversions. The Meta tag does not get your name, email or phone number.
- Interaction recording by Microsoft Advertising. The Microsoft tag loads UET Insights, which may record how you interact with our pages: clicks, scrolling and typing activity, but not the contents of password fields. Microsoft uses it to help us improve our ads.
- Google Analytics. On our public pages, Google Analytics shows us how people find and use our site. It sets cookies and sends Google details such as the pages you view, your device and browser, and your approximate location. Google processes this under its own policies; see how Google uses information from sites that use its services. We have turned off Google signals, ad personalization and Google's data-sharing settings for it, so it isn't used for advertising, and Google keeps this data for 14 months. You can also block it with Google's opt-out browser add-on.
- Session recordings by Microsoft Clarity. On our public pages, Microsoft Clarity shows us how visitors use them, through heatmaps and session recordings of clicks, scrolling and mouse movement. It uses cookies and similar technologies, and it masks what you type into form fields, so recordings don't capture it. Microsoft processes the data under the Microsoft Privacy Statement.
- No other advertisers or data brokers. Apart from the three advertising tags above, we do not sell or share browsing data with advertisers or data brokers.
- No social media widgets. Links to our social accounts are plain links.
- No other session-replay or heatmap tools. Apart from Microsoft's UET Insights and Microsoft Clarity described above, nothing on our pages records your mouse movements, keystrokes, or screen.
Our own analytics is cookieless
We use Vercel Web Analytics to see aggregate page views and traffic sources. It sets no cookies and stores no identifier in your browser. It does not follow you between visits or between sites, and it produces counts, not profiles.
Our own site analytics sets no cookies either. As you move around raileon.com, it records which pages you view and in what order, the site that sent you (its name, not the full link), any campaign tags in the link (UTM tags), your device type (phone, tablet or computer) and the time. In the signed-in dashboard it records only which page you open, with any ID in the address removed, never what is on the page. A random ID kept in your browser's session storage groups one visit, and it is cleared when you close the tab. It doesn't store your name, email address or IP address with these records. We delete the raw records after 90 days and keep only daily totals.
Google Analytics and Microsoft Clarity on our public pages are different: they set the cookies listed in Section 2 and are described above.
Why there is no cookie banner
Consent banners exist so that you can refuse non-essential cookies. Apart from the advertising and analytics cookies, every cookie described in Section 2 is either strictly necessary for authentication or abuse prevention, a staff-only support marker, a display preference set only after you have signed in and asked for it by toggling the sidebar, or a referral cookie set only when you arrive through a partner's link. Where advertising cookies need your consent first (the EU, the UK and Switzerland), we don't load the advertising or analytics tags when your browser is set to a European time zone, and Google's tag sets no cookies for visitors it locates there. Everywhere else you can turn them off with the “Do not sell or share my info” link at the bottom of every page, Global Privacy Control (Section 5) or your browser settings. The one other optional thing on the site (loading TradingView's market chart) already asks before it does anything, via the click-to-load prompt in the dashboard rather than a banner on every page. If we ever introduce a cookie that requires consent outside these controls, we will ask for it before setting the cookie, not after.
Other browser storage
The platform uses your browser's local and session storage for short-lived interface state, such as an unsent draft or a panel you have open. That data stays in your browser, is not transmitted to us as a cookie, and is cleared when you clear your site data. Our public pages also keep where you came from (the page you landed on, the site that sent you, and the campaign tags and ad click IDs in that link, such as utm_source or gclid) in session storage, and send it with the booking form so we know which ad or link brought you. It is cleared when you close the tab. Our own site analytics keeps its random visit ID and the last page it recorded there too (rl_vid and rl_vprev), and they are cleared the same way. If you click “Do not sell or share my info”, we remember that in local storage (rl_no_ads) until you clear your site data.
4. Controlling cookies
Cookies are controlled from your browser, and you do not need our permission to change them. Every major browser lets you view the cookies a site has set, delete them, block them for a specific site, or block them everywhere. Look for cookies or site data under Settings, Privacy, or Preferences, in Chrome, Edge, Firefox, Safari, and Brave alike.
Deleting cookies for raileon.com signs you out. Blocking them stops you from signing in at all.
Blocking sidebar_state specifically is harmless. Your sidebar will simply open in its default position every time.
5. Do Not Track and Global Privacy Control
Some browsers send a Do Not Track (DNT) header or a Global Privacy Control (GPC) signal to tell sites you do not want to be tracked or have your personal information sold or shared. There is no agreed industry standard for how sites must respond to DNT, so many ignore it.
Our position: we don't sell personal information for money, but under some state laws our advertising tags (Section 3) can count as “sharing” it. If your browser sends a Global Privacy Control signal, or you click “Do not sell or share my info” at the bottom of any page, we don't load these advertising tags or Google Analytics or Microsoft Clarity, and our own site analytics stops sending anything. The one third-party embed inside the product (the market chart) is load-on-click rather than something that runs by default, so there is nothing running in the background for it to disable either. For the California privacy rights this signal ties into (including the right to opt out of the “sale” of personal information), see the US State Privacy Rights section of our Privacy Policy.
6. Changes to this policy
If we add, remove, or change the purpose of a cookie, we will update the table in Section 2 and revise the effective date at the top of this page in the same change. For material changes (in particular, introducing any cookie that is not strictly necessary or functional), we will notify account holders by email or through the platform at least 15 days before the change takes effect, and we will obtain consent where the law requires it.
We apply this policy the same way to everyone. Rather than deciding what you are entitled to based on where you happen to be, we extend the protections described here to all users regardless of location.
7. Contact us
Questions about this Cookie Policy, or about a cookie you have found that is not listed here:
SkyRaileon LLC, a Florida limited liability company
Miami, Florida
privacy@raileon.com: data-protection matters
admin@raileon.com: general inquiries
For the full picture of what we collect and why, see our Privacy Policy.