Cookie policy
Last updated: 30 September 2026
We use a small set of cookies to keep the site working. Some are strictly necessary; others (where they exist) ask for your consent first via the banner you see on your first visit.
You can withdraw consent for non-essential cookies at any time by clicking the small “cookie preferences” link in the footer (or by clearing your browser cookies for this site).
What we set
| Cookie | What for | How long | Category |
|---|---|---|---|
| pawspot_token | Keeps you signed in. HttpOnly + Secure (in production), so your browser handles it but JavaScript can't read it. | 30 days | Strictly necessary |
| pawspot_session | Marker the frontend reads to know you're signed in (so the header can show your avatar without an auth round-trip). Holds nothing sensitive. | 30 days | Strictly necessary |
| pawspot_consent | Remembers your cookie banner choice (accept / reject). | 6 months | Strictly necessary |
| Stripe cookies | Stripe sets these on the checkout page to fight fraud and keep your payment session secure. We don't read them. | Various, set by Stripe | Strictly necessary |
| pawspot_source_v1, pawspot_session_v1, pawspot_tracked_fields_v1, pawspot_tracked_paths_v1 (sessionStorage, not cookies) | Small notes in your browser's tab-scoped storage: where your visit came from (e.g. Google), a random visit id, and which pages were already counted so refreshes don't double-count. Nothing here identifies you and nothing is sent to third parties. | Cleared automatically when the tab closes | Analytics (see below) |
None of these track you across sites. We don't set advertising cookies and we don't use any third-party analytics (no Google Analytics, no pixels). What we do have is our own first-party page counter: if you choose “Accept all” on the banner, we record which pages are visited, roughly where visits come from (source like Google or direct, plus city-level area worked out from your IP address — which we don't store), and the device category (phone / tablet / computer, nothing more specific). No account link, deleted after 90 days. If you choose “Necessary only”, that counter stays off entirely.
Separately — and not controlled by this banner — if you tick the optional box at signup or turn it on in Settings → Privacy, we record the pages you visit linked to your accountwhile you're signed in. That's its own opt-in consent, off by default, withdrawable in Settings (which also deletes what's been recorded) — see our privacy policy for the full details.
Strictly necessary vs. consent
Under UK PECR, “strictly necessary” cookies don't require your consent, that's the small set above, all of which are needed to keep you signed in or process a payment securely. Anything beyond that (analytics, marketing, ad-targeting) requires your positive opt-in via the banner. We don't pre-tick boxes; reject is as easy as accept.
Changing your mind
You can withdraw consent at any time:
- Use the “cookie preferences” link in the footer to reopen the banner
- Or clear cookies for
pawspot.co.ukin your browser settings, the banner will ask again on your next visit - Most browsers also let you block specific cookies or all cookies. The site will mostly still work, but you won't stay signed in between visits.
Contact
Questions about cookies, or about how we handle your data more broadly? Email hello@pawspot.co.uk. The full data-handling story is in our Privacy Notice.