Cookie Policy, and when we ask first

1. When you see a consent banner

Most cookies below are strictly necessary to keep you signed in, or remember a preference you expressed yourself. Both categories are exempt from the consent requirement under the EU ePrivacy Directive and equivalent rules elsewhere, so we never ask about them.

Tracking cookies are different. Our own Google Analytics and PostHog (section 4), and any Meta Pixel, Google Ads tag, Google Analytics or Microsoft Clarity project a business has connected to its own booking page or website, all set cookies. If you are in the European Union, the wider European Economic Area, the United Kingdom or Switzerland, none of them sets a cookie until you choose. A banner asks you first, with Accept all and Reject all given equal weight, and Manage to allow analytics, session insights or advertising one by one. Meta Pixel, Microsoft Clarity and PostHog do not load at all until you accept. Google's tags load in Google's consent mode instead: until you accept, they read and write no cookie and send Google only cookieless signals with no identifier, such as that a page was viewed, which Google uses to estimate totals without recognising you. Accepting switches them to full measurement; rejecting keeps them that way. A choice about our own analytics never counts as a choice about a business's trackers, or the other way round: each is asked separately. You can change your answer at any time from "Cookie settings" in the page footer, or in your profile in the dashboard. Everywhere else, these load when the page does and you can block them as described in section 5.

Wherever you are, if your browser sends a Global Privacy Control signal, we treat it as a standing no: none of these trackers loads and no banner is shown.

The analytics tool built into the booking pages we host (section 3) never needs a banner anywhere: it sets no cookie and keeps no record connecting one visit to the next, so it runs regardless of any of the above.

2. The cookies we set

That is the complete list of cookies THIS SITE and our own dashboard set, apart from Google Analytics' own on this marketing site (section 4). A public booking page or website we host sets the same nothing UNLESS its owner has connected their own Meta Pixel, Google Ads tag, Google Analytics or Microsoft Clarity project (section 4), in which case that platform's own cookies apply on that one page. A visitor who only books an appointment on a page with none of those connected receives no cookie from us at all, the analytics tool described next included.

3. Website analytics (not a cookie)

Booking pages we host run a private, self-hosted instance of Umami, an open-source analytics tool, so a business can see how many people visited its page. It works without a cookie: a visitor is identified for statistics by a hash of their IP address, browser and the calendar day, computed fresh, never written to a cookie or to your device's storage, and discarded at the end of that day. There is nothing here that would let us, or anyone, connect today's visit to tomorrow's, or to a visit on a different website.

The full detail of what this tool collects and why it needs no consent is in section 4 of the Privacy Policy.

4. Related storage

Four things worth mentioning that are not strictly cookies we set. Your answer to a consent banner (section 1) is remembered in your browser's local storage, separately for each site and each business, so you are not asked on every visit; it is never sent to us. Our interactive demo keeps its sample data in your browser's local storage so the sandbox survives a page reload; it is never sent to us and clearing your browser data removes it. Stripe's hosted payment fields set their own cookies for fraud prevention when you reach a checkout page. Those are governed by Stripe's cookie policy, and we do not control or read them.

When you make a booking, join a waitlist or send an enquiry on a booking page, an invisible bot check from Vercel, our hosting provider, looks at signals from your browser to tell a person from an automated script, so nobody can flood a business with fake bookings. It asks you to do nothing, and it is used only for that check, never to follow you around the web or for advertising.

A business that connects its own Meta Pixel, Google Ads tag or Google Analytics to its booking page and website (Settings > Booking rules > Ad tracking & analytics, off by default) causes that page to load Meta's and Google's own scripts, which set their own cookies to measure that business's ad campaigns and visits. Same footing as Stripe above: those cookies are set and governed by Meta and Google directly, not by us, and only ever appear on a page whose owner switched this on. In the regions listed in section 1 they set no cookie until you accept that business's banner (Meta's does not load at all before then, and Google's sends only the cookieless signals described there); beyond that, disclosing them to their own visitors as their jurisdiction requires is that business's responsibility.

A business that connects its own Microsoft Clarity project (Settings > Booking rules > Heatmaps & recordings, off by default) causes that page to load Clarity's own script, which sets Microsoft's own cookies and identifiers to record clicks, scrolling and, depending how that business has configured its own Clarity project, a session replay. Same footing again: set and governed by Microsoft directly, not by us, only ever on a page whose owner switched this on, behind the same banner in the regions listed in section 1, and otherwise that business's responsibility to disclose to its own visitors as its jurisdiction requires. Whatever that business's own Clarity settings, a guest's details and payment on the booking page are masked, as section 4 of the Privacy Policy describes.

Different footing for this one: we run PostHog on this marketing site and on the dashboard app, after you accept where section 1 says we ask, where it is listed under session insights and loads only once you allow those. Its requests go to relay.gaplessly.com, an address on our own domain that PostHog operates and forwards to PostHog. It sets one first-party cookie, ph_ followed by our project key, lasting up to a year, so a returning visitor is recognised, and records page views, clicks and a session replay, so we can see how the product is actually used and improve it. On the dashboard every piece of text and every form field is masked in those recordings. This is us, not a business's own account, and it applies whether you are a prospective customer browsing this site or a signed-in user of the dashboard; it is never active on a booking page or a business's own website, which stay governed only by what that business has itself connected, as described just above.

Same footing as PostHog, on a narrower surface: we run Google Analytics on this marketing site only, never on the dashboard, a booking page or a business's own website. Once you accept (or straight away outside the regions in section 1), it sets two first-party cookies, _ga and _ga_ followed by our property ID, each lasting up to two years, so a returning visitor is counted once rather than as someone new. We use what it reports to understand our own marketing, not for advertising. Blocking these cookies, or installing Google's own opt-out browser add-on, stops it with no effect on anything else.

5. Turning them off

Every browser lets you block or delete cookies in its settings. Blocking ours is entirely your right, with one practical consequence: the authentication cookies are what a signed-in session is, so blocking them means you cannot stay signed in to the dashboard. Blocking sidebar_state costs you nothing but a collapsed sidebar. A booking page sets no analytics cookie to block; on this marketing site, blocking the Google Analytics and PostHog cookies (section 4) costs you nothing at all. If you would rather not be counted in the aggregate visit numbers anywhere, your browser's own tracking-protection or script-blocking settings are the tool for that, not a switch we provide.

Questions go to privacy@gaplessly.com.