Cookie Policy

The short version

ReportPoppy sets a small number of cookies, all of them necessary to sign you in and keep you signed in. There is no advertising cookie, no analytics cookie, and no third-party tracker anywhere in the product, which is why you are not being asked to accept anything.

Every cookie we set

• rp_session — your signed-in session. A random token, HttpOnly so page scripts cannot read it, SameSite=Lax. Cleared when you sign out.
• poppy_bearer — your Poppy ID credential when you sign in through the suite. Same protections.
• poppy_state — a short-lived value that ties a sign-in round trip to the browser that started it. Ten minutes.
• poppy_next — where to put you back after that round trip. Ten minutes.
• poppy_tried — a note that the silent suite sign-in has already been attempted, so the app does not loop through it again. Five minutes.

Every one of these is strictly necessary. Blocking them means you cannot sign in.

What a client link sets

Nothing. A client opening a report you shared is not signed in to anything, is not given a session, and is not tracked. The page needs no cookie to render, because it is replaying a snapshot that was already frozen.

Third parties

Two fonts are loaded from Google Fonts, and the suite switcher script is loaded from OfficePoppy. Neither sets a ReportPoppy cookie. MLS photographs are served through our own server rather than hot-linked, so viewing a report does not hand your client to anyone else.

Your control

Your browser can clear or block cookies for reportpoppy.com at any time, and signing out clears the session cookie immediately. See Privacy Choices for the rest.