Cookie policy

This is the whole list. Four cookies, all of them ours, all of them there to sign you in and to keep forms from being submitted on your behalf by someone else. Nothing here follows you between sites, and there is nothing on this page you are being asked to agree to.

1. What cookies are

A cookie is a small piece of text a website asks your browser to keep and send back with later requests. It is the mechanism by which a website recognises that the request submitting a form came from the same browser that loaded the form, and by which you stay signed in as you move between pages. Without something of the kind, every page view would be a stranger arriving.

Cookies are not all alike, and the differences are what the law turns on:

• Strictly necessary cookies do a job the service cannot be provided without — holding your sign-in, protecting a form, remembering which items you put in a basket.
• Analytics cookies count visits and record what people do, so the site's owner can measure it.
• Advertising cookies build a picture of you across different websites so that advertising can be aimed at it.

We set only the first kind, which is also the only kind that does not require your consent. Two related technologies, local storage and session storage, do a similar job without being cookies; the same law covers them, so they are set out in section 4 rather than left unmentioned.

2. The cookies we set

Every cookie below is first-party: set by our own domain, sent only back to us, and readable by nobody else. There are no others.

How they are set

• All are marked Secure in production, so a browser will only send them over an encrypted connection.
• All are SameSite=Lax, which stops them being attached to requests another site makes on your behalf. That is a large part of what makes cross-site request forgery hard.
• The session and remember-me cookies are HttpOnly: scripts running in the page cannot read them, which limits what an injected script could steal. The token cookie is deliberately readable, because our own scripts have to echo its value back in a header.
• Cookie values are encrypted before they leave our servers, so their contents are opaque — to you, and to anyone reading them off your machine.
• None of them contains your name, email address, company or anything you have typed. Your session's contents sit on our infrastructure; the cookie is only the key to them.

The session cookie is set on your first page view, before you have signed in or filled anything in. That is not a trick: the contact form on the public site needs a token to protect it, and the token needs a session to belong to. What is stored is a random identifier with nothing attached to it, and it expires 2 hours after your last request.

3. Why there is no cookie banner

The rule is in the Privacy and Electronic Communications Regulations 2003. Consent is required before storing information on your device, or reading information back off it, unless doing so is strictly necessary to provide a service you have actually asked for.

Every cookie in section 2 falls inside that exception. Without them you cannot sign in, and you cannot submit a form without it being rejected. We set no analytics cookies and no advertising cookies, we run no tag manager, and — as section 5 sets out — there is no third party in a position to set anything through this site at all.

So there is nothing here to ask you about. A banner offering an accept button and no genuine alternative is not consent; it is a click you have to make before you can read the page. We would rather publish the list and let you check it.

If we ever add storage that is not strictly necessary — product analytics, a support chat widget, an embedded video, a conversion pixel — then before it is set for the first time we will publish an updated version of this page and ask you for consent. Refusing will be as easy as accepting, the site will work if you refuse, and we will not treat carrying on browsing as agreement.

Separately from cookies, our servers keep request logs — a timestamp, an IP address, the path requested and the response code — for security and for working out what went wrong. That is not storage on your device and needs no consent, but you should know it happens. Our privacy notice covers what is in those logs and how long we keep them.

4. Local storage

Local storage is a small store your browser keeps for a website, and it differs from a cookie in one respect that matters here: it is never attached to a request, so nothing in it is ever sent to us. We use it for one thing, which is remembering how you want the interface to look.

None of these identifies you, none of them is sent to us, and clearing site data in your browser removes all of them. The only consequence is that the interface goes back to its defaults.

The 2003 Regulations cover local storage as well as cookies, so the consent question applies here too. We take the view that these entries are exempt, because each one exists solely to carry out a preference you have set yourself by pressing something. Nothing is written until you do.

5. Third parties

Nothing on this site is loaded from anyone else's server, which means no other party is in a position to set a cookie through us even if it wanted to. Specifically:

• No analytics of any kind in the page: no Google Analytics, no tag manager, no product analytics service.
• No advertising or conversion pixels, and no social media buttons or share widgets.
• Fonts are compiled into our own assets and served from our own domain rather than fetched from a font service, so viewing a page makes no request to anybody else.
• The illustrations are inline drawings in the page itself, not images pulled from an image host.
• No embedded video, no maps and no live chat widget.
• No payment iframe, because we do not take card payments. Account top-ups are made by bank transfer and recorded against your account by us. If we add a payment provider it will be a third party, and this page will name it before it goes live.
• The public API sets no cookies at all. Every request authenticates with an API key, so an integration never carries browser state and never needs to.

Royal Mail, DPD, Evri and DHL appear on this site as plain text. We embed no carrier tracking widgets or scripts, and we are an independent reseller rather than a partner of any of them. If you follow a link to a carrier's own website you are on their site, under their cookie policy, which we neither control nor see.

6. Controlling cookies in your browser

Every mainstream browser lets you see what a site has stored, delete it, and refuse more of it. It is normally under the privacy section of the settings:

• Chrome — Settings, then Privacy and security.
• Firefox — Settings, then Privacy & Security.
• Safari — Settings or Preferences, then Privacy.
• Edge — Settings, then Cookies and site permissions.

A private or incognito window achieves the same thing for a single visit: everything stored is discarded when you close it.

What stops working if you block ours

We would rather be plain about this than pretend the site degrades gracefully in every direction.

• Reading the public site — unaffected. Every marketing page, including this one, renders without a single cookie being accepted.
• The contact form — will fail on submission, because the token protecting it cannot be checked against a session that was never kept.
• Signing in — will not work at all. The form will be rejected each time, usually as a page-expired error, and there is no way around it: both the token and the signed-in state live in cookies.
• Deleting them later — signs you out and returns the interface to its defaults. Nothing in your account is touched. Shipments, labels, statements and invoices are held on our servers, not in your browser.
• Blocking local storage only — everything works, but the theme and sidebar settings stop persisting between visits.
• The API — unaffected in every case. It runs on keys, not cookies.

On Do Not Track and Global Privacy Control: we set nothing that follows you between sites, so there is nothing for either signal to switch off here. If we ever add anything of that kind, we will honour them.

7. Changes to this policy

This page is kept in step with the code. When a cookie is added, removed or renamed, the tables above and the date at the top of the page change with it. We would rather this document be dull and correct than broad and safe.

Anything beyond strictly necessary storage gets your consent before it is set, not afterwards. Material changes will be notified to account holders by email or in the portal.

This policy sits alongside our privacy notice, which covers personal data more broadly, and our terms of service. Questions about any of them go to support@parcelpointpro.com.