Legal
Cookie and browser storage policy
This policy records how Pocketa currently uses cookies, localStorage, sessionStorage and related browser technologies across the public site and signed-in workspace.
Essential storage supports authentication, security, requested tool state and your cookie choice. Optional analytics tags are blocked unless you accept analytics, and only load on public marketing pages in the production deployment. After acceptance they can measure website use and advertising conversions such as account sign-ups. Using the site does not itself count as analytics consent.
Last updated: August 2026
1. Scope and terminology
A cookie is a small value a website asks a browser to send back with later web requests. Browser storage keeps values on the device without automatically attaching them to every request. Pixels and scripts can make requests to third parties and may read or set identifiers where their configuration permits.
These technologies are governed by UK privacy and electronic communications rules according to their purpose, not merely their technical name. Storage that is strictly necessary for a service you request can operate without optional analytics consent. Optional analytics cannot.
2. Analytics choice
On a browser with no recorded choice for the current analytics purpose version, Pocketa displays a choice between Accept analytics and Reject analytics. Leaving the banner without choosing does not count as consent. The result is stored under pocketa-cookie-consent in localStorage.
- Missing, legacy unversioned, or unrecognised value: analytics tags do not load and consent-gated product events are dropped. The choice banner is shown again.
analytics-rejected:v2: analytics tags do not load and consent-gated product events are dropped.analytics-accepted:v2: consented analytics can load after the page becomes interactive on public marketing pages in the production deployment only. It does not inject on sign-in or account-recovery pages, the signed-in/appworkspace, protected supplier-token routes, or non-production deployments (including preview).
When analytics purposes change in a material way, Pocketa bumps the purpose version so earlier accept or reject choices no longer satisfy consent and the banner reappears. The current interface controls one optional analytics category. It is not a granular marketing or vendor-by-vendor preference centre. Application code does not install a separate Google Ads tag. Consented Google Analytics on production marketing pages, including a short noindex confirmation page after account creation, can measure advertising conversions when Google Ads is linked to that Analytics property.
3. Strictly necessary authentication and security
Supabase authentication uses secure, provider-generated cookies so the server can verify and refresh a signed-in session. Exact cookie names come from Supabase (often including the project reference) and may be split into chunks.
Blocking authentication cookies prevents the signed-in workspace from recognising the account. It does not merely make the user log in more often. Cloudflare Turnstile can also use browser and interaction signals on the supplier application form to prevent automated abuse.
4. Functional browser storage
The public estimator and project-setup handoff use first-party browser storage to preserve a draft across refresh, authentication or a temporary storage failure. Estimator answer drafts, import payloads, seed snapshots and pending setup answers carry a seven-day expiry. A session copy may disappear sooner when the browser tab or session ends.
The signed-in checklist also uses session storage for expanded rows, open sections and dismissed related-item prompts. These values control the interface only. The actual saved checklist, spending and sourcing records remain server-side workspace data governed by the Privacy policy.
5. Optional analytics
Pocketa uses consent-gated analytics on public marketing pages in the production deployment. When analytics is not accepted, the application does not inject the analytics script and its analytics event helper discards events. After acceptance, Google Analytics tags can set _ga and related identifiers and receive limited event payloads from those marketing surfaces, including conversion events used to measure advertising such as account sign-ups.
Sign-in pages and the signed-in project workspace do not inject analytics tags, even after acceptance. That keeps authentication and project URLs out of ordinary page analytics. First-party interaction events remain consent-gated; without the analytics script they do not reach Google Analytics.
Pocketa's estimator and editorial analytics helpers are designed to send interaction categories and non-identifying context, not email addresses, free-text project notes or cost-organiser financial records. Google can still receive ordinary technical request data such as IP address, browser information and the requested page under its service controls on surfaces where analytics is injected.
6. Supplier links and commercial attribution
Pocketa does not set a long-lived marketing partner cookie when you simply read a guide or browse sourcing pages. Partner click records are created only when a signed-in homeowner deliberately follows an eligible retailer route.
When that happens, Pocketa records the click server-side before redirecting to the external website. That record can include the user, an owned project when supplied, the partner, category, destination and source surface. The external website then receives normal browser request data and applies its own cookie policy. Supported quote, consultation and sample submissions have separate, explicit data-sharing confirmations described in the Privacy policy.
Signed-in Claim deal and partner Visit actions on Checklist and Current offers can also create a first-party learning record (partner, offer when present, surface, optional checklist section, clean merchant destination, and whether a voucher was copied). Signed-in Share shop link and Share this list actions can create a first-party share record (project, share kind, how many options, how many tracked shop links). Those records help Pocketa improve which offers appear beside renovation stages and whether a different person is being sent the shop links. They are not marketing analytics tags, do not require the analytics cookie choice, and do not store raw IP addresses. Admin staff can review aggregates; rows are removed with other workspace behavioural data when a project is erased.
7. Current technology registry
This registry lists the first-party keys and provider-controlled categories confirmed by the current application. Wildcards represent generated project, provider or analytics identifiers rather than a single literal key.
| Technology | Provider | Location | Classification | Duration | Purpose |
|---|---|---|---|---|---|
| sb-<project-reference>-auth-token* | Supabase | Cookie | Strictly necessary | Managed and refreshed by Supabase session settings; cleared or expired through authentication controls | Maintains and refreshes the signed-in session. The exact generated name can be chunked and depends on the configured Supabase project. |
| pocketa-cookie-consent | Pocketa | localStorage | Strictly necessary preference | Until you change the choice or clear browser storage | Stores the current analytics purpose version as analytics-accepted:vN or analytics-rejected:vN. Older unversioned or previous-version values are ignored so the choice banner reappears after a material analytics-purpose change. Analytics tags load only when the current accepted value is present, and only on public marketing pages in the production deployment. |
| pocketa:kitchen-cost-estimator:answer-draft:v1 and pocketa:kitchen-cost-estimator:answer-draft-fallback:v1 | Pocketa | sessionStorage with localStorage fallback | Strictly necessary functional | Usable for seven days; the expired value is removed when next read. The session copy can end sooner. | Preserves public estimator answers and a limited result summary across refreshes or a failed session-storage write. |
| pocketa:kitchen-cost-estimator:project-import:v1 and pocketa:kitchen-cost-estimator:project-import-fallback:v1 | Pocketa | sessionStorage with localStorage fallback | Strictly necessary functional | Usable for seven days; cleared when the handoff completes or when next read after expiry | Carries an estimator result into the project setup journey you chose to start. |
| pocketa:kitchen-cost-estimator:seed-snapshot:v1 and pocketa:kitchen-cost-estimator:seed-snapshot-fallback:v1 | Pocketa | sessionStorage with localStorage fallback | Strictly necessary functional | Usable for seven days; the expired value is removed when next read | Carries the structured estimator snapshot used to offer optional project imports. |
| pocketa:project-setup-pending:v1 and pocketa:project-setup-pending-fallback:v1 | Pocketa | sessionStorage with localStorage fallback | Strictly necessary functional | Usable for seven days; the expired value is removed when next read | Preserves validated project setup answers while authentication or project creation completes. |
| pocketa-checklist-open-items:*, pocketa-checklist-open-sections:* and pocketa-related-item-prompts-dismissed:* | Pocketa | sessionStorage | Strictly necessary functional | Current browser-tab session | Remembers expanded checklist controls and dismissed prompts. The wildcard suffix is the relevant project identifier. |
| pocketa:estimator-seed-prompt-lifecycle:* | Pocketa | localStorage | Strictly necessary functional | Until overwritten for that snapshot or browser storage is cleared | Remembers which optional estimator-import prompts have been completed or skipped for a project. |
| _ga and related Google Analytics identifiers after analytics acceptance | Google Analytics | Cookie | Optional analytics | Set by the Google Analytics tag in use; Google defaults can retain identifiers for up to two years | Distinguishes browser visits and supports aggregate website-use reporting and advertising conversion measurement after analytics acceptance. |
| Provider-generated Turnstile browser signals | Cloudflare | Cookie, local storage or comparable browser signal | Strictly necessary security | Controlled by Cloudflare for the protected interaction | Helps protect supplier applications, contact, feedback, Updates and other configured public forms from automated abuse. |
8. Change or withdraw your analytics choice
Use Cookie settings in the site footer, on this page, in Account, or in Help to reopen the current choice. Selecting Reject analytics prevents analytics tags from loading on later page loads. The control does not automatically delete analytics cookies already placed after an earlier acceptance.
To remove existing cookies or browser-storage values, use your browser's site data controls. Blocking or clearing all site data can sign you out, discard an unsaved estimator or setup draft, and reset checklist display preferences. It does not erase server-side account or project records; use the privacy routes for those requests.
9. Third-party controls
Google, Supabase and Cloudflare publish their own information about provider-set cookies, storage, duration and privacy controls. External supplier and retailer websites also control their own technologies after you follow a link away from Pocketa. Their policies apply on their services.
10. Policy updates and contact
Pocketa updates this registry when application storage keys, consent categories, configured vendors or retention behaviour materially change. The last-updated date identifies the published version.
For a cookie or browser-storage question, use Contact and state that the message concerns privacy. For processing purposes, retention, rights and complaints, read the Privacy policy.
Appendix: analytics container note
On public marketing pages in the production deployment, consented analytics is loaded through Google Tag Manager container GTM-5XDGH4T4. Dashboard tag settings sit outside this source repository. Linked Google Ads conversion measurement, where configured, also sits in those dashboards. The registry above describes the application-level consent gate and the known Google Analytics cookie identifiers; it does not claim that application code alone proves every dashboard setting.
See also Personal data safety, Privacy policy, and Terms of use.