Cookie Policy

Cookies are small text files a website stores on your device; local storage is a related browser feature with a longer lifetime, and this page covers both. It explains what saffronseal.com stores, why, and what choices you have. It supplements our Privacy Policy.

1. Strictly necessary

These keep you signed in, protect sign-in against cross-site request forgery, let a payment complete and let our edge network tell people from bots. The Platform does not work without them, so they are exempt from consent and cannot be switched off.

• authjs.session-token, authjs.csrf-token, authjs.callback-url (with a __Secure- or __Host- prefix on https) — set by SaffronSeal; your session, CSRF protection and the page to return to after sign-in. Session length 30 days; the others last for the browser session.
• __cf_bm — set by Cloudflare, our edge network, to distinguish humans from automated traffic. Expires within 30 minutes of inactivity.
• __stripe_mid, __stripe_sid — set by Stripe on checkout pages for payment security and fraud prevention. One year and 30 minutes respectively.
• saffronseal:cookie-consent (local storage) — remembers whether you accepted or rejected analytics, so we do not ask on every visit. 12 months.

2. Analytics — off until you accept

We use Google Analytics 4 to see, in aggregate, which pages get read and where people drop off. It is the only optional category we use, it never feeds advertising, and it is opt-in everywhere, not only where the law requires it: the Google tag is not loaded until you choose "Accept analytics" in the banner, and Google Consent Mode v2 stays denied for every storage type until then. There are no pre-ticked boxes, and "Reject" is exactly as prominent as "Accept". A decision is remembered for 12 months, after which we ask again.

• _ga, _ga_<stream-id> — set by Google Analytics 4 only after you accept; distinguish visitors and sessions for aggregate statistics. Two years.

3. What we do not do

• No advertising cookies (no Google Ads, Meta/Facebook Pixel, TikTok Pixel or equivalents).
• No cross-site behavioural tracking and no device fingerprinting.
• No selling or sharing of personal information through cookies.

4. How to change your mind

The button below, or Cookie preferences in the footer, opens the same panel and takes effect immediately. Withdrawing analytics also deletes the Google Analytics cookies already on your device.

Manage cookie preferences

You can also block or delete cookies in your browser settings (Chrome: Settings → Privacy and security; Safari: Settings → Privacy; Firefox: Settings → Privacy & Security; Edge: Settings → Cookies and site permissions). Blocking the strictly necessary ones signs you out and stops bookings from completing.

5. Global Privacy Control

If your browser sends a Global Privacy Control signal we treat it as a binding opt-out: we do not show the banner, analytics stays off, any Google Analytics cookies already on your device are deleted, and we tell you on screen that the signal was honoured.

6. Changes and contact

When this policy changes we update the date at the top. Questions: support@saffronseal.com.