Cookie Policy
What we store on your device, why, for how long — and how to change your choices at any time.
Last Updated: June 26, 2026
Cookies are small text files a website stores on your device. On our public website we group them into three categories. Strictly necessary storage is always on; analytics and marketing are denied by default and load only after you allow them. We apply Google Consent Mode v2, so until you consent no advertising or analytics cookies are written.
Our legal basis for strictly-necessary storage is our legitimate interest in operating a secure service (and, for the consent record, a legal obligation). For analytics and marketing the basis is your consent, which you can withdraw at any time below. These scripts never load on the dashboard or admin area. The wider data-protection detail lives in our Privacy Policy (Section 8).
What we use
Cookies by category
Strictly necessary
Always active — required for sign-in, security and to remember your cookie choice. No consent is asked because the site cannot work without them.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| cc_cookie | HTPBE (first-party) | Stores your cookie-consent choice so the banner is not shown again. | 6 months |
| authjs.session-token, authjs.csrf-token | HTPBE (first-party) | Keeps you signed in and protects forms against cross-site request forgery. | Session / short-lived |
| htpbe_utm, htpbe_gclid | HTPBE (first-party) | First-touch source and ad-click identifier, used to attribute a later sign-up to the campaign that brought you here. | 90 days |
Analytics
Off until you allow them. Help us see which pages are useful so we can improve them. Our cookieless traffic counter (Umami) runs without consent and sets no cookie.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 | Distinguishes visitors and sessions to produce aggregate usage statistics. | Up to 2 years |
| _clck, _clsk | Microsoft Clarity | Session replay and heatmaps to find usability problems. | 1 day – 1 year |
Marketing
Off until you allow them. Let us measure and improve our advertising so we do not waste budget on ads that miss the right people.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Conversion linker — measures ad-driven sign-ups and purchases. | 90 days |
| _fbp | Meta (Facebook) Pixel | Measures ad performance and builds advertising audiences. | 90 days |
Your choices
Current consent state
- Always on
Strictly necessary
Sign-in, security and remembering your cookie choice. Always active — the site cannot work without them.
- …
Analytics
Google Analytics and Microsoft Clarity, so we can see which pages help. Our cookieless traffic counter runs without consent and is not part of this category.
- …
Marketing
Google Ads and Meta Pixel, so we can measure and improve our advertising.
Third-party providers
When enabled, these providers receive data directly from your browser and process it under their own privacy policies:
- Google (Analytics & Ads) — policies.google.com/privacy
- Microsoft (Clarity) — privacy.microsoft.com
- Meta (Facebook Pixel) — facebook.com/privacy/policy