Cookies and similar technologies

Cookie policy

Every cookie and piece of browser storage TradeTraining uses, what each one is for, how long it lasts, and which ones wait for your permission.

Takes effect: [EFFECTIVE DATE]. Written on 22 October 2026 from what the site and app actually store.

Draft, awaiting legal review

This page describes what the site actually does, but it has not yet been reviewed by a solicitor. Details shown in [square brackets] are still being filled in or confirmed.

What these are

A cookie is a small file a website stores in your browser. Browsers also offer similar storage, called local storage and session storage, and an installable web app can keep its own files on your device. UK law (the Privacy and Electronic Communications Regulations, PECR) treats all of these the same way, so this page lists all of them, not only cookies.

Your choice

Strictly necessary and functional items are always on. They keep you signed in, remember your cookie choice and remember settings you picked, and they are not used for analytics or advertising.
Analytics (PostHog, and Google Analytics) and advertising (Meta and Google) wait for your choice in the cookie banner. Nothing from them loads before you choose, and saying no is as easy as saying yes. Advertising cookies tell Meta and Google which of our ads brought you here, and let them use that to decide who sees our ads.
Your choice covers only the tools the banner named when you made it. “Accept all” accepts a kind of cookie only if the banner named a tool for it. If we add a tool later, it stays off and the banner asks you again.
You can change your mind at any time in . It is in the footer of our public pages, in the app’s sidebar on a larger screen and its More menu on a phone, in Profile settings, and on the sign-in pages. Turning something off stops it and deletes the cookies it set on our site.

Advertising tags run only on our public pages, and only while you are not signed in, as a guest or otherwise. They never run in the app, on the sign-in, sign-up and password pages, where you may type an email address or password, on the account-deletion page, or on our content-management pages. Google Analytics follows the same rule: its tag runs only on our public pages while you are signed out, and only if you accept analytics cookies. With that consent, our server may also read its _ga cookies to tell Google Analytics when you start as a guest, finish the opening questions or finish your first lesson. For how we use the information these collect, see our privacy notice.

Strictly necessary

Needed for something you have asked for, such as staying signed in, or to remember your cookie choice. These do not wait for consent, because the site cannot do what you asked without them.

sb-<project ref>-auth-token

Set by: Supabase
Type: cookie
What it is for: Keeps you signed in, including as a guest. A long session can be split across several cookies ending .0, .1 and so on. For a guest account it is the only way back in, so clearing it before you save your progress loses that progress.
How long: Up to 400 days, renewed while you use the app. Removed when you sign out.
Where: Every page, once you start as a guest or sign in.
Waits for consent?: No. The site needs it to do what you asked.

sb-<project ref>-auth-token-code-verifier

Set by: Supabase
Type: cookie
What it is for: Completes a sign-in that goes through an email link or another site, such as a password reset or continuing with Google or Facebook, so that only the browser that started it can finish it.
How long: Removed when that sign-in completes.
Where: Sign-in, sign-up, save-progress and password-reset pages.
Waits for consent?: No. The site needs it to do what you asked.

tt_recovery

Set by: TradeTraining
Type: cookie
What it is for: Set when you open a password-reset link, so that only the browser that opened the link can choose the new password. It holds a random value, nothing about you.
How long: 30 minutes, or until you set the new password.
Where: The password-reset pages, after you open a reset link.
Waits for consent?: No. The site needs it to do what you asked.

tt_consent

Set by: TradeTraining
Type: cookie
What it is for: Remembers your cookie choice (analytics yes or no, advertising yes or no) and when you made it, so we load only what you agreed to and do not ask on every page. Our server reads it too, so the events it sends follow the same choice.
How long: About 6 months, then we ask again. Changing your choice replaces it.
Where: Every page, once you choose.
Waits for consent?: No. The site needs it to do what you asked.

Cloudflare Turnstile

Set by: Cloudflare Turnstile
Type: browser check
What it is for: The bot check on guest starts. It reads your IP address, browser details and the fingerprint of your browser's secure connection to tell people from automated scripts. Any cookies it uses, such as __cf_bm or cf_clearance, are set on Cloudflare's own domain under Cloudflare's cookie policy, not on ours.
How long: Set by Cloudflare.
Where: Pages with a button to start as a guest, while the bot check is switched on.
Waits for consent?: No. The site needs it to do what you asked.

tt:ad-tag-reloads

Set by: TradeTraining
Type: session storage
What it is for: If the advertising tags or Google Analytics loaded on one of our public pages and you then go into the app or sign in, the page reloads once so that no advertising or Google Analytics code stays running there. This records when each page last did that, so a page never reloads itself more than once in 30 seconds. It holds page addresses and times, nothing else, and is not sent to anyone.
How long: Until you close the tab.
Where: Only after you accept analytics or advertising cookies, on the page where you leave our public pages.
Waits for consent?: No. The site needs it to do what you asked.

Functional

Remember a setting you chose or your place in a lesson. They stay on your device and are not sent to anyone.

tt:notice-acknowledged:<notice id>

Set by: TradeTraining
Type: local storage
What it is for: Remembers when you choose ‘I have read this’ on a learning-path safety notice, so it stays compact. You can reopen the full notice at any time. It stores only the wording version, not account or learning data.
How long: Until you clear site data. Updated wording is shown in full again.
Where: The plumbing learning path, only after you acknowledge the notice.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt-theme

Set by: TradeTraining
Type: local storage
What it is for: Remembers that you chose the light or dark theme. Set only when you press the theme switch; until then your device's own setting decides.
How long: Until you clear this site's data in your browser.
Where: The app.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt:lesson-resume:<lesson id>

Set by: TradeTraining
Type: session storage
What it is for: Remembers where you are in a lesson in this browser tab, so a reload carries on rather than starting again. Your answers are already saved to your account; this holds only your place.
How long: Until you finish the lesson or close the tab.
Where: Lessons.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt:lesson-unsaved:<lesson id>

Set by: TradeTraining
Type: session storage
What it is for: Holds answers and card reads in a lesson that have not reached your account yet, for example while your connection is down, so they are sent again rather than lost if the page reloads. Each one is removed as soon as it is saved.
How long: Until each one is saved, or you close the tab.
Where: Lessons.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt-sitting-<lesson id>

Set by: TradeTraining
Type: cookie
What it is for: When you practise a lesson you have already finished, names the questions picked for that practice run, so a reload brings back the same questions and your place. Sent only to that lesson's page. It holds question ids, nothing about you or your answers.
How long: 6 hours, or until you finish the practice run.
Where: Lessons you have already finished.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt:streak-milestone-celebrated

Set by: TradeTraining
Type: local storage
What it is for: Remembers the last streak milestone you were congratulated on, so the celebration does not repeat. Holds a single number.
How long: Until you clear this site's data in your browser.
Where: The Learn page.
Waits for consent?: No. It stays on your device and is not sent to anyone.

tt:first-lesson-nudge

Set by: TradeTraining
Type: local storage
What it is for: Remembers that you have closed the message we show a guest after their first lesson, offering to save their progress or set a daily goal, so it is not shown again. It holds one word, nothing about you or your learning.
How long: Until you clear this site's data in your browser.
Where: The Learn page, for guests.
Waits for consent?: No. It stays on your device and is not sent to anyone.

serwist-precache-<version>

Set by: TradeTraining
Type: app file cache
What it is for: Keeps copies of the app's own code files and icons, so the installed app opens quickly. It holds nothing about you: pages and your data always come fresh from our server.
How long: Replaced when we release a new version. Removed if you clear this site's data.
Where: Every page, in browsers that support installable web apps.
Waits for consent?: No. It stays on your device and is not sent to anyone.

Analytics

Help us understand how people find our public pages and use the app, so we can fix problems and improve lessons. These load only if you accept them.

ph_<project key>_posthog

Set by: PostHog
Type: cookie and local storage
What it is for: Gives this browser a random ID so PostHog can tell visits apart, and holds the current analytics session. Deleted if you turn analytics off.
How long: 1 year.
Where: Set on the first page that records analytics (a lesson, review, onboarding, the Plus page or our ad landing page), or on any page of the app once you have started as a guest or signed in, where it links this browser to your account ID. After you sign out, it is given a new random ID before anything else is recorded.
Waits for consent?: Yes. Nothing sets it until you accept.

ph_<project key>_window_id, ph_<project key>_primary_window_exists

Set by: PostHog
Type: session storage
What it is for: Tell your browser tabs apart within one visit. Deleted if you turn analytics off.
How long: Until you close the tab.
Where: Pages that record analytics.
Waits for consent?: Yes. Nothing sets it until you accept.

__ph_opt_in_out_<project key>

Set by: PostHog
Type: local storage
What it is for: PostHog's own record that you turned analytics off, or back on. It only exists if you accepted analytics at some point, and it is kept after you turn analytics off because it is what keeps PostHog switched off.
How long: Until you clear this site's data in your browser.
Where: Pages that record analytics.
Waits for consent?: Yes. Nothing sets it until you accept.

_ga

Set by: Google Analytics
Type: cookie
What it is for: Google Analytics' random ID for this browser, so it can tell visits apart. While our server's Google Analytics events are switched on, and only if you accept analytics, our server also reads it when you start as a guest, finish the opening questions or finish your first lesson, to add those three steps to the same visit. Deleted if you turn analytics off.
How long: About 6 months, renewed while you use our public pages.
Where: Our public pages, such as the home page, the topic and practice pages and our ad landing pages, and only while you are signed out. Google Analytics' tag never runs once you start as a guest or sign in, inside the app, or on sign-in, sign-up, password, account-deletion or content-management pages. Inside the app, only our server reads it, for the three steps named in its purpose.
Waits for consent?: Yes. Nothing sets it until you accept.

_ga_<container-id>

Set by: Google Analytics
Type: cookie
What it is for: Holds your current Google Analytics visit (when it started and how many visits you have made), so the pages you see in one visit count as one visit. Our server reads it under the same rule as _ga. Deleted if you turn analytics off.
How long: About 6 months, renewed while you use our public pages.
Where: Our public pages, such as the home page, the topic and practice pages and our ad landing pages, and only while you are signed out. Google Analytics' tag never runs once you start as a guest or sign in, inside the app, or on sign-in, sign-up, password, account-deletion or content-management pages. Inside the app, only our server reads it, for the three steps named in its purpose.
Waits for consent?: Yes. Nothing sets it until you accept.

Advertising

Measure whether our ads on Facebook, Instagram and Google lead to people trying a lesson, and let Meta and Google use that to decide who sees our ads. These load only if you accept them.

_fbp

Set by: Meta (Facebook and Instagram ads)
Type: cookie
What it is for: Meta's ID for this browser, used to measure our ads and to show them to people likely to be interested. Deleted if you turn advertising off.
How long: 90 days, renewed on each visit.
Where: Our public pages, such as the home page, the topic and practice pages and our ad landing pages, and only while you are signed out. The advertising tags never run once you start as a guest or sign in, inside the app, or on sign-in, sign-up, password, account-deletion or content-management pages.
Waits for consent?: Yes. Nothing sets it until you accept.

_fbc

Set by: Meta (Facebook and Instagram ads)
Type: cookie
What it is for: Records the Facebook or Instagram ad you clicked to reach us, if you came from one. Deleted if you turn advertising off.
How long: 90 days.
Where: Our public pages, such as the home page, the topic and practice pages and our ad landing pages, and only while you are signed out. The advertising tags never run once you start as a guest or sign in, inside the app, or on sign-in, sign-up, password, account-deletion or content-management pages.
Waits for consent?: Yes. Nothing sets it until you accept.

_gcl_au, _gcl_aw and other _gcl_ items, including _gcl_ls

Set by: Google (ads measurement)
Type: cookie and local storage
What it is for: Google's conversion linker: connects a guest start to the Google ad that led to it, and records the ad you clicked to reach us, if you came from one. It keeps that in cookies and, as _gcl_ls, in your browser's local storage. All of them are deleted if you turn advertising off.
How long: 90 days.
Where: Our public pages, such as the home page, the topic and practice pages and our ad landing pages, and only while you are signed out. The advertising tags never run once you start as a guest or sign in, inside the app, or on sign-in, sign-up, password, account-deletion or content-management pages.
Waits for consent?: Yes. Nothing sets it until you accept.

Meta's and Google's own cookies

If you accept advertising cookies, Meta’s and Google’s tags can also read and set cookies on their own websites’ domains (such as facebook.com and google.com), for example if you are signed in to them. Those are controlled by Meta and Google, under their own policies: Meta cookies policy and how Google uses cookies.

Controlling cookies in your browser

Your browser’s settings let you see and delete cookies and site data, and block them. If you block or delete the sign-in cookie you will be signed out, and a guest account you have not saved with an email address cannot be recovered. Questions about this page: [CONTACT EMAIL].