Cookie Policy
Last updated: 1 August 2026
The short version
Cosavio uses only cookies that are strictly necessary to sign you in and keep the service secure. We do not use advertising cookies, we do not track you across other websites, and our analytics do not use cookies at all.
That is why you do not see a cookie consent banner. Under the Privacy and Electronic Communications Regulations 2003 (PECR) regulation 6, consent is required before storing or accessing information on your device except where it is strictly necessary to provide a service you have asked for. Everything below falls in that exception.
If that ever changes — if we add advertising, embedded media, or cookie-based analytics — we will add a compliant consent banner with a "Reject all" option as prominent as "Accept all", and non-essential cookies will not fire until you choose.
What is actually set
Strictly necessary — no consent required
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
sb-udwhencemronfhpvdroq-auth-token (and its numbered chunk variants) | Cosavio, via Supabase | Keeps you signed in and refreshes your session as you move between pages. Without it you cannot use the application. | For as long as your session stays active — refreshed while you use the app, removed on sign-out |
sb-udwhencemronfhpvdroq-auth-token-code-verifier | Cosavio, via Supabase | Protects the sign-in and password-recovery handshake against interception (PKCE). | Short-lived — only for the duration of a sign-in or recovery attempt |
| Cloudflare Turnstile | Cloudflare | Distinguishes real people from bots on the sign-up and sign-in forms. Without it those forms are open to automated abuse. | Sets no cookies on cosavio.com (checked 1 August 2026). The widget runs inside an iframe on challenges.cloudflare.com and keeps its short-lived challenge state there. |
Analytics — cookieless
We use Plausible Analytics, which is privacy-focused and EU-hosted. It sets no cookies, stores nothing on your device, does not use a persistent identifier, and does not track you across sites. It reports aggregate figures only — page views, referrer, country, browser and device type.
Because it does not store or access information on your device, PECR regulation 6 consent is not triggered. We rely on legitimate interests under UK GDPR for the aggregate statistics.
Not used
We do not use: advertising or retargeting pixels (no Meta Pixel, no Google Ads tag, no LinkedIn Insight tag), cross-site trackers, social media embeds that set cookies, session recording, or heatmaps.
Third-party pages
The identity-verification journey is hosted by our verification provider, Certivus, on its own domain. Once you are handed off to it, that provider's cookie and privacy notices apply — see certivus.com/privacy.
Managing cookies
You can block or delete cookies in your browser settings. Blocking the strictly necessary cookies above will stop you being able to sign in.
Browser instructions: Chrome · Safari · Firefox · Edge
Questions: privacy@cosavio.com