Cookie Policy

A "Cookie" is a small text file placed on your device when you visit a website. "Similar Technologies" include local storage, session storage, service-worker caches, pixel tags and device fingerprints, each of which can perform functions equivalent to cookies. In this Policy references to Cookies include such Similar Technologies unless the context requires otherwise.

Strictly necessary Cookies. We rely on the strictly-necessary exemption in Regulation 6(4) PECR for Cookies that are essential to provide the service you have requested (for example, authentication, session continuity, load balancing, and security).

All other Cookies. For functional, analytics and advertising Cookies, we rely on your prior, freely given, specific, informed and unambiguous consent, collected via our cookie banner in accordance with Regulation 6(1) PECR and Article 6(1)(a) UK GDPR.

Strictly necessary. Authentication tokens, CSRF tokens, load- balancer stickiness, service-worker registration, and security cookies. These cannot be switched off.

Functional. Cookies that remember your preferences (theme, language, cookie consent state, notification permissions). Disabling these will reduce the Platform's ability to remember your settings.

Analytics. Cookies and pixels that help us understand aggregate use of the Platform. We use Google Analytics 4 and the Meta Pixel. Neither is loaded until you accept analytics cookies via the consent banner or the preferences panel above; if you choose "Essential only" they are never loaded and no requests are made to Google or Meta.

Advertising. We do not currently run third-party ad networks on the Platform, so no advertising Cookies are set inside the authenticated Platform. The only advertising-category tag we use is the Meta Pixel on logged-out marketing pages, and only with your consent. Invite+ Members see no promotional placements at all.

A full up-to-date inventory of Cookies in use, including provider, purpose, category and duration, is available from the cookie preference panel accessed from the footer of the Platform. Representative examples are given below.

Strictly necessary examples. sb-access-token (session), sb-refresh-token (session refresh, ~30 days), CSRF protection token (session), and service worker registration (persistent, browser-managed).

Functional examples. cookie-consent (12 months) and preference caches held in local storage.

Analytics examples. Aggregated event logs (retained no longer than necessary to produce operational statistics).

Advertising examples. None are currently set. The Meta Pixel is loaded on logged-out marketing pages only, and only where you have consented to advertising Cookies.

Some Cookies are set by third parties operating tools we integrate. Where a third party sets Cookies as an independent controller, their own policies apply. The principal third parties are:

Stripe. Fraud-prevention and checkout continuity Cookies (strictly necessary during a payment flow).

Managed backend provider. Cookies necessary to maintain your authenticated session (strictly necessary).

Advertising networks. We do not currently serve third-party ad-network advertising (such as Google AdSense) on the Platform. Promotional placements are sold and served by us directly and do not set advertising Cookies. If that changes, this Policy and the preference panel will be updated before any such Cookie is set.

Meta / Facebook Pixel. On logged-out marketing pages only, and only where you have granted advertising-Cookie consent, we may load the Meta Pixel to measure marketing effectiveness. It is not loaded inside the authenticated Platform. Meta acts as an independent controller for its own purposes.

Consent record. Your Cookie preferences and the timestamp at which they were given are recorded and retained for twelve (12) months, or until you change them, for the purpose of demonstrating compliance under Article 7(1) UK GDPR.

You may accept, reject, or granularly configure non-essential Cookies at any time via the cookie preference panel accessible from the site footer. Rejecting non-essential Cookies is as easy as accepting them.

Browser controls. Most browsers let you block or delete Cookies. Doing so may prevent some parts of the Platform from working correctly.

Withdrawal. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can continue to use the core features of the Platform without non-essential Cookies. Some conveniences (remembered preferences, analytics improvements, tailored advertising) will not be available.

We honour recognised Global Privacy Control (GPC) signals as an expression of a refusal of consent to non-essential Cookies. Where a browser transmits a GPC or comparable signal we treat it as an objection to non- essential processing.

We may amend this Cookie Policy from time to time. Where consent requirements change, we will re-request consent through the cookie banner before setting affected Cookies.