Cookies Policy
1. What cookies are
Cookies are small text files placed on your device when you visit a website. We also use a couple of similar technologies — local storage, and session tokens — and we treat all of them under this single policy for clarity.
2. Our approach
We try to keep cookies to the minimum needed to run the service. We don't use advertising cookies. We don't use cross-site tracking. We don't share cookie data with data brokers.
No banner pop-up. Because we only set strictly-necessary cookies by default, you don't have to dismiss a banner before reading. If we ever add optional categories, you'll see a clear opt-in.
3. Strictly necessary
These cookies make the service work — sign-in, security, and CSRF protection. They're set automatically and don't require consent under PECR.
| Name | Purpose | Lifetime |
|---|---|---|
planning_consult_session | Sign-in session token | 2 hours of inactivity |
XSRF-TOKEN | Cross-site request forgery protection | 2 hours |
remember_web_* | Set only if you tick "remember me" — keeps you signed in across browser sessions | 30 days |
__cf_bm | Cloudflare bot management | 30 minutes |
4. Analytics
We do not currently use Google Analytics, Plausible, or any third-party analytics that profile visitors. We collect aggregate usage stats from server logs (page hits, response times, error rates) — these are anonymised and used to keep the service running.
If we ever introduce a privacy-respecting analytics tool, this page will be updated and you'll see an explicit opt-in if it sets cookies.
5. Marketing
We don't currently set any marketing or advertising cookies. If that ever changes, this policy will be updated and you'll see an explicit consent prompt before any non-essential cookie is set.
6. Third-party services
Some pages embed components from third parties — these can set their own cookies according to their own policies.
| Service | Where | Why |
|---|---|---|
| Stripe | Checkout pages (£19 PDF / £69 statement) | Process card payments, prevent fraud |
| Cloudflare | All pages | CDN, DDoS protection, bot management |
| Sign-in only — if you choose Google sign-in, the Google account chooser sets its own cookies on accounts.google.com | One-click sign-in |
7. Managing cookies
You can clear or block cookies in your browser at any time. Note that blocking the strictly-necessary set will sign you out and prevent you from running paid checks.
You can also use your browser's "Do Not Track" or Global Privacy Control signals — we honour both for any optional categories we add in future.
8. Changes
We'll update this page when our cookie usage changes. The "Last updated" date at the top tells you when. Material additions (e.g. a new analytics processor) will be flagged on the homepage for 30 days.