Legal
Cookie notice
- Effective
- [Effective date]
- Draft last edited
- Status
- Not in force
DRAFT — pending counsel review
This document is a complete working draft written by the product team. It has not been reviewed by a qualified lawyer, it is not yet in force, and it is published here so it can be reviewed in context. Do not rely on it. Every bracketed value is a fact the operator must supply before this page can take effect; they are all listed at the foot of the page.
We use the cookies needed to sign you in and keep the site secure, one to remember your appearance and locale preferences, and — only with your consent — one to measure aggregate usage. There is no advertising, retargeting or cross-site tracking on this site.
Section 1
What this notice covers
This notice explains the cookies and similar technologies — local storage and session storage included — used on this website. It takes effect on [Effective date] and sits alongside the privacy notice, which explains how the resulting personal data is handled.
Section 2
What we do not use
Stated first, because it is the shorter and more useful list:
- no advertising or retargeting cookies;
- no cross-site tracking or data-broker pixels;
- no social-network embeds that set third-party cookies;
- no fingerprinting used to identify you across sites or to work around a refused consent.
The service is funded by subscriptions, so there is no advertising business to feed with this data.
Section 3
What we do use
Strictly necessary cookies are set without consent because the service cannot function without them. Everything else is set only after you agree.
| Purpose | Category | Lifetime |
|---|---|---|
| Sign-in sessionKeeps you signed in between pages. Set by our identity provider. Without it the product cannot know who you are. | Strictly necessary | Session, or until you sign out |
| Security tokenProtects form submissions against cross-site request forgery. Removing it would make the account pages unsafe to use. | Strictly necessary | Session |
| Consent recordRemembers the cookie choice you made, so we do not ask again on every visit and so we can evidence what you chose. | Strictly necessary | Up to 12 months |
| Theme and localeRemembers light or dark appearance and your date and number formatting. Set only once you change a setting. | Preference | Up to 12 months |
| Aggregate usage measurementCounts page and feature usage so we can see where searches fail. Only set if you consent, and configured without cross-site identifiers. | Analytics | Up to 12 months |
Section 4
Giving and withdrawing consent
Consent is collected through [Cookie consent tool]. Refusing optional cookies is as easy as accepting them: there is no pre-ticked box, no “legitimate interest” toggle left on by default, and no repeated prompt after a refusal.
You can change your choice at any time from the same control, and withdrawing consent stops any further optional cookies being set. Cookies already set are deleted when you withdraw, or you can clear them in your browser.
Blocking strictly necessary cookies in your browser will prevent you signing in, but the public pages will still work.
Section 5
Analytics, if enabled
Where analytics are deployed, the provider is [Analytics provider], configured so that it does not set cross-site identifiers and does not receive search queries, airports, dates or saved balances. We use it to see which features are used and where a search fails, not to build a profile of you.
Section 6
Questions
Questions about this notice, or about a cookie you have seen that is not listed here, go to privacy@[domain]. If we have missed one, we will either document it or remove it.
Facts the operator must supply before this document takes effect
4 bracketed values appear in this document. Each one is a fact, not a missing clause — the wording around it is complete.
- [Effective date]
- The date this version of the document takes effect. Set it when counsel signs off, not before.
- privacy@[domain]
- Mailbox for data-subject requests: access, correction, deletion, portability and objection.
- [Cookie consent tool]
- The consent mechanism deployed in production, including how a customer withdraws consent later.
- [Analytics provider]
- The analytics product used, if any, and whether it is configured without cross-site identifiers.