Legal
Cookie Policy
Last updated: 2026-05-24
1. What are cookies?
Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as local storage, session storage and pixel tags.
2. Cookies we use
Strictly necessary (no consent required)
| Cookie | Provider | Purpose | Expires |
|---|---|---|---|
sb-[ref]-auth-token | Supabase | User session authentication | Session / 1 week |
__cf_bm | Cloudflare | Bot management (Turnstile) | 30 minutes |
Analytics / performance (consent required under PECR)
Under UK PECR (regulation 6) we set these cookies only after you give consent through the cookie banner shown on your first visit. You can withdraw consent at any time using the controls described in §3 below; on withdrawal the cookies are cleared and no further analytics events are collected from your browser.
| Cookie | Provider | Purpose | Expires |
|---|---|---|---|
ph_*_posthog | PostHog (EU) | Distinct-id and session identifier for product analytics (page views, feature usage, funnels). | 1 year (rolling on activity) |
ph_*_window_id | PostHog (EU) | Browser-tab session identifier used to group events within a single tab. | Session |
onrolo_consent | Onrolo | Stores your cookie-consent choices so the banner doesn’t reappear on every page. | 12 months |
3. Managing cookies
The first time you visit Onrolo a banner asks you to accept, reject, or customise non-essential cookies. Your choice is stored in the onrolo_consent cookie above and respected on subsequent visits.
To change your choice at any time, scroll to the footer of any public page and click Cookie preferences. This re-opens the banner so you can grant or withdraw consent. We treat withdrawing consent as no more demanding than giving it, as required by Article 7(3) UK GDPR.
Where you reject or withdraw analytics consent, we clear the relevant cookies from your browser and stop sending events from your session.
You can also control cookies via your browser settings (for example, block all third-party cookies, or clear stored cookies on exit). Note that disabling strictly necessary cookies will prevent you from signing in.
4. Changes
We will update this policy when we add or remove cookies. Check the “last updated” date above.