Cookie Policy
Effective date: April 15, 2026
Last updated: October 13, 2026
This policy explains what cookies and similar technologies SigmaShake uses on our web properties (sigmashake.com, accounts.sigmashake.com, hub.sigmashake.com, docs.sigmashake.com, promo.sigmashake.com, and related subdomains).
What We Use
SigmaShake uses first-party cookies for sign-in, security checks, and a few preferences. Analytics sent to analytics.sigmashake.com is cookieless today. Analytics cookies would be set only with a future consent control. We do not use third-party advertising cookies or cross-site advertising. We add no advertising tag. See "Google Analytics" below for the Google tag, which sets no cookies today.
Strictly Necessary Cookies
These cookies are required for the service to function. They cannot be disabled.
| Cookie | Domain | Expiry | Purpose |
|---|---|---|---|
session_id | .sigmashake.com | Persistent: 24 hours for OAuth sign-ins, 8 hours (idle) for enterprise SSO, 30 days for magic-link sign-in | Authentication session token. HttpOnly, Secure, SameSite=Lax. Contains a random session identifier — no personal data. |
oauth_state | accounts.sigmashake.com | 5 minutes | Sign-in security check. Holds a random state value for one OAuth sign-in or account-link round trip. HttpOnly, Secure, SameSite=Lax. The server deletes it after the round trip. |
rdt_join | accounts.sigmashake.com | 15 minutes | Set only in the Reddit community-invite join flow. Proves join intent at the callback. Holds your email address and a signature. HttpOnly, Secure, SameSite=Lax. |
sso_session | sso.sigmashake.com | 8 hours | Sign-in session for the SigmaShake single sign-on service (the identity provider). HttpOnly, Secure, SameSite=Lax. |
ssg_fleet_session | Host-only, on the Fleet control-plane host | 8 hours | Signed-in session for the Fleet dashboard, set after an SSO or device sign-in. HttpOnly, Secure, SameSite=None. |
promo_session | promo.sigmashake.com (host-only) | Persistent (30 days) | Signed sign-in session for promo.sigmashake.com. HttpOnly, Secure, SameSite=Lax. |
promo_oauth_state_<nonce> | promo.sigmashake.com (path /auth) | 10 minutes | Sign-in security check for one OAuth round trip on promo.sigmashake.com. The name carries a random nonce, so two sign-in tabs do not overwrite each other. HttpOnly, Secure, SameSite=Lax. |
Preference and Usage Cookies
| Cookie | Domain | Expiry | Purpose |
|---|---|---|---|
ssg_qs_dismissed | accounts.sigmashake.com (host-only) | 365 days | Remembers that you dismissed the quick-start panel on the account dashboard. The value is 1. Set by page script. Secure, SameSite=Lax. |
sigma_resume | .sigmashake.com | 1 day | Set when you return with an existing session. It holds the current UTC date, and the server uses it to send at most one session-resume ping per day. Secure, SameSite=Lax. |
Local and Session Storage
promo.sigmashake.com keeps a small set of values in your browser storage. You can clear them in your browser settings.
| Storage | Keys | Purpose |
|---|---|---|
localStorage | ads-creative:<slug>; promo_first_run_done_<slug> | A saved ad draft for a channel; a flag that the first-run guide is finished for a channel. |
sessionStorage | ads-landing-draft; ads-tos-accepted; promo_first_run_pending_<slug>; promo_first_run_done_<slug>; ads-claim-token:<...>; promo.buyIntent; ads-buyer-notifications-seen; ads-navi-last-play; promo-build-reloaded | Checkout and listing drafts, terms acceptance, first-run state, claim status, and page-reload guards. They last for one browser tab. |
Analytics Cookies (First-Party, Not Set Today)
No consent banner exists. Nothing sets the sigma_consent cookie today. For this reason, analytics stays in the no-consent mode for every visitor, and the site sets neither sigma_anon nor sigma_sid today.
In the no-consent mode, the site sets no analytics-identifier cookie. The sigma_resume cookie above is not an analytics identifier. It only prevents more than one daily sign-in analytics event (session_resume) for a signed-in user. That event carries your account identity (user ID and login name) to analytics.sigmashake.com. It also deletes any old sigma_anon or sigma_sid cookie. It uses a random id for each page load. That id lives in memory and is not stored.
If a future consent control sets sigma_consent=granted, the site tracker reads sigma_consent, sigma_anon, and sigma_sid. It then sets the cookies below.
| Cookie | Domain | Expiry | Purpose |
|---|---|---|---|
sigma_consent | n/a | n/a | Read by the site. Nothing sets it today. If set to granted, it turns on the two cookies below. |
sigma_anon | .sigmashake.com | 365 days | Not set today. With consent, the site would set it as an anonymous visitor identifier: a random UUID, not linked to your account. It would count unique visitors. |
sigma_sid | .sigmashake.com | Session (no expiry) | Not set today. With consent, the site would set it as a session cookie: a random UUID per browser session. The browser deletes it when the session ends. |
What We Track
Events are sent with a random id that lives in memory for one page load. With future consent, the sigma_anon and sigma_sid identifiers above would be used instead. We collect the following analytics events and send them to our self-hosted analytics service at analytics.sigmashake.com:
- Page views (path, referrer hostname, UTM parameters)
- Install command copied
- Pricing section viewed
- Checkout started / completed
We do not track:
- Your identity across other websites
- Mouse movements or keystrokes
- Any data from the
ssgCLI (CLI telemetry is separate and disclosed in the CLI documentation)
Google Analytics
sigmashake.com pages: These pages load the Google tag (GA4 measurement ID G-H278WSFB0K). GA4 runs in Consent Mode v2 with all storage denied by default (ad_storage, ad_user_data, ad_personalization, analytics_storage). No consent banner exists and nothing sets sigma_consent today. For this reason, GA4 sets no cookies and sends cookieless pings only. If sigma_consent=granted were present, the site would grant analytics_storage only. Ad storage would stay denied.
promo.sigmashake.com: When Google Analytics is enabled, this site loads Google's tag and sends page views to Google Analytics. We set the measurement ID in the Cloudflare dashboard, not in the code. The promo tag also runs in Consent Mode v2 with all four storage types denied by default. This site has no consent banner, and the promo code sends no consent update. The promo site never reads sigma_consent, so the denied default stays in place. The page views cover the public site and the signed-in dashboard. They do not cover the OBS overlay or the celebrate view. If Google Analytics is not configured, the tag is not loaded. With no consent, Google Analytics sets no cookies on this site and sends cookieless pings only.
No advertising or remarketing tag is added on any site.
How to Control Cookies
Browser settings: You can block or delete cookies in your browser settings. Note that disabling the session_id cookie will prevent you from logging in.
Consent: No consent banner exists today. The site analytics cookies stay off, because nothing sets sigma_consent=granted. You can block or delete cookies in your browser at any time. On any site with the Google tag you can also block www.googletagmanager.com to stop Google Analytics page views.
Changes
We may update this policy when we add new functionality. The "Last updated" date at the top will reflect changes. Continued use of our services after changes constitutes acceptance.
Related Policies
- Privacy Policy — how we collect and use your personal data
- Acceptable Use Policy — what you may and may not do with our services
Contact
Questions: [email protected]