Cookie Policy

Cookies and similar technologies

A cookie is a small text file that a website asks your browser to keep, and which the browser sends back on your next request. Cookies are how a site can tell that two visits came from the same browser, which is what makes it possible to stay signed in rather than proving who you are on every click.

Browsers offer other kinds of storage that work in a similar way, such as local storage and session storage. The rules that govern cookies in the UK, the Privacy and Electronic Communications Regulations, apply to all of it, so this policy covers everything CoApplyBoard stores on your device, not only the things technically called cookies.

This policy sits alongside our Privacy Policy, which explains what we do with personal information generally.

The one cookie we set

CoApplyBoard sets a single cookie, named __Host-coapplyboard-session. It is created when you sign in and it identifies your session, nothing else. It carries no name, no email address and no personal details of any kind; its value is an opaque signed token that only our servers can read.

It is set with every protection a browser offers. It cannot be read by scripts running in the page, so a cross-site scripting flaw could not steal it. It is only ever sent over an encrypted connection. It is not sent with requests that another website’s page makes to ours in the background, so a page elsewhere cannot act as you. It is locked to this exact domain and cannot be widened to a subdomain. And its name is prefixed __Host-, which is a browser-enforced guarantee that all of the above is true.

It expires after ten minutes of inactivity, and it is refreshed each time you do something, so a session in continuous use does not time out mid-task. Signing out deletes it, and signing out also ends every other session on every other device.

The cookie is strictly necessary. Without it there is no way to stay signed in, so the dashboard, your board and your documents are unreachable. Blocking it does not degrade the service; it makes signing in impossible.

What your browser stores on its own

Two pieces of information are held in your browser’s session storage, which lasts only as long as the tab you are using and is never transmitted to us.

The first is the name, email address and phone number you type into the form on our home page. They are stored on your own tab so that the sign-up form can be filled in for you when you get there, saving you typing the same four things twice. If you close the tab before signing up, they are gone and we never receive them. If you do sign up, they reach us as part of the sign-up form, in the ordinary way.

The second is which plan you chose on the pricing page, so that the plan you clicked is the plan waiting for you at checkout. It carries no personal information at all.

Once you sign in, one more thing is stored. The sign-in library we use, provided by Google’s Firebase, keeps your signed-in state in your browser’s own database (called IndexedDB) so that your board can load without asking you to sign in again on every page. It holds a short-lived token for your account, nothing you have typed, and it is removed when you sign out. It is created only when you go to sign in, never for a visitor reading this site.

The first two are read once and cleared. None of the three is a cookie, none is sent with any request to us, and none is used to recognise you on a later visit.

What we do not do

We set no analytics cookies. We do not use Google Analytics or any comparable product, and we do not measure your journey through the site.

We set no advertising or marketing cookies, we do not run retargeting or conversion pixels, and we do not share anything with an advertising network. Nothing about your visit is used to follow you to another website.

We embed no third-party trackers, no social media widgets, no chat scripts, no session recording and no heat mapping. Our pages load no code from anyone else’s tracking infrastructure. The images and fonts on the site are served from our own domain rather than fetched from a third party as you browse.

We do not build a profile of your browsing, we do not fingerprint your device, and we do not sell or share what you do here with anyone.

Why there is no cookie banner

UK law requires your consent before a website stores anything on your device, with one exception, for storage that is strictly necessary to deliver a service you have asked for. Signing in is exactly that exception, and it is the only category we use.

That is why you have not been shown a banner. A consent banner exists to give you a real choice about non-essential tracking, and asking you to consent to the only cookie that makes signing in possible would be a choice you cannot meaningfully decline. We would rather not set the tracking than ask you to agree to it.

If we ever introduce a cookie that is not strictly necessary, we will ask for your consent before it is set, through a proper consent mechanism that lets you refuse as easily as accept and change your mind later. It will not arrive through a quiet update to this page.

Managing cookies and storage in your browser

Every major browser lets you see what a site has stored, delete it, and block future storage. In Chrome and Edge it is under Settings, then Privacy and security, then Cookies and site data. In Safari it is Settings or Preferences, then Privacy, then Manage Website Data. In Firefox it is Settings, then Privacy & Security, then Cookies and Site Data. You can also clear everything for one site from the padlock icon in the address bar.

Deleting our cookie signs you out. Blocking it prevents you from signing in at all, because there is no other way for the service to recognise your session; this is not a limitation we have chosen, but a consequence of the cookie being the session.

Nothing else we store affects you if you clear it: at worst the sign-up form starts empty and you pick your plan again.

If you would like to know more about cookies generally, the Information Commissioner’s Office publishes plain-English guidance at ico.org.uk.

Content from other websites

Our pages sometimes link out: to an employer, to a job advert, or to a regulator such as the ICO. Following a link takes you to a site we do not control, which will have its own cookies and its own policy. This policy stops at our edge, and we would encourage you to read theirs.

Stripe’s checkout page is one such place, and so is Klarna’s if you choose to pay that way. When you pay, you are on their page, under their cookie policy, and your card details go to them rather than to us.

Changes to this policy

The date at the top and bottom of this page tells you when it was last revised, and the current version is always the one published here.

A change that introduced a cookie which is not strictly necessary would be notified in advance, by email to account holders and by a consent prompt on the site, rather than by an edit to this page. That is a commitment about how we will behave, and it is the one thing on this page most worth holding us to.