Cookie Policy
Last updated: 8 August 2026
Your choice
Essential cookies and browser storage keep the service secure and preserve the journey you request. PostHog and Google Analytics do not load until you opt in to analytics. Rejecting analytics does not prevent the core service from working. You can reopen Cookie Settings in the footer and withdraw consent at any time.
Essential storage
| Name/type | Purpose | Typical duration |
|---|---|---|
| cmr_flow_session | Signed, HTTP-only flow authority for the selected customer/property journey. | 14 days |
| Supabase auth cookies | Authentication and account session. Names can vary by project. | Session/configured auth lifetime |
| cmr_cookie_consent | Local storage of your analytics choice and policy version. | Until cleared or policy version changes |
| Flow/Stripe/appointment handoff storage | Session-only continuity while returning from card verification or using a private appointment reminder. Sensitive URL values are removed from the address bar before analytics capture. | Browser session; appointment reminder tokens expire after 14 days |
| Referral and interface preferences | Preserve a referral code or a dismissed interface prompt. | Until cleared or no longer applicable |
Optional analytics
| Provider | Purpose and safeguards | Retention |
|---|---|---|
| PostHog (EU) | Explicit product/page events and error diagnostics after opt-in. DOM autocapture and session replay remain disabled; appointment/Stripe secrets and raw email/address are excluded. | Set in the PostHog project and subject to the launch retention review. |
| Google Analytics | Page and traffic-source measurement after opt-in. Google signals and advertising personalisation are disabled. | Set in the GA4 property and subject to the launch retention review. |
We do not currently load Google Ads or offer a separate advertising-cookie choice. A browser Global Privacy Control or Do Not Track signal keeps optional analytics disabled. Analytics configuration also fails closed when the required environment variables are absent.
Managing storage
Use Cookie Settings in the footer to change your choice. On withdrawal we stop future PostHog capture, clear its browser storage, tell Google Analytics that storage is denied and attempt to remove first-party analytics cookies. Session replay and DOM autocapture are disabled even after opt-in. Your browser settings can also block or delete storage. Blocking essential cookies may prevent sign-in, secure returns or saved journey progress.
Contact
Questions: privacy@challengemyrates.co.uk. See the Privacy Policy for legal bases, processors, transfers and your rights.