For everyone. Short, because there are not many.
Cookies and similar technologies
UK law lets us set the cookies a service cannot work without. Everything else needs your consent first, so everything else is off until you give it.
Last updated 22 August 2026
Strictly necessary - always on
These are set because the service cannot function without them. They do not track you across sites and are not used for advertising.
| Cookie | What it does |
|---|---|
| Session cookie | Keeps you signed in. Signed, HTTP-only, and cleared when you sign out. |
| Consent choice | Remembers which of analytics and advertising you accepted or declined, so we stop asking. Stored on your device until you clear it or change your mind. |
| Security tokens | Short-lived values used to verify sign-in links and prevent request forgery. |
| Error monitoring (Sentry) | Keeps the service working, so it runs outside the consent categories. In the app and the dashboard it may store a short-lived session marker for crash replay; replays mask all text and input and never include what you typed. |
Analytics - off unless you say yes
We use Google Analytics on our marketing sites, inside the Coco Card app and inside the business dashboard, to see which screens are useful. IP addresses are anonymised, and in the Coco Card app we record the page path only - never the query string (on the marketing sites and in the dashboard, Google's enhanced measurement also counts scrolls, outbound link clicks, file downloads and site searches, and records the page address it happened on). None of it runs unless you accept the analytics category in the banner. Each Coco Card site asks for and stores your choice separately - a choice made on one site does not carry to the others - and declining costs you nothing: everything works either way.
Advertising - a separate question, asked separately
The marketing site is built to load the Meta pixel - which would tell us which Facebook or Instagram ads actually brought someone here - only after you accept a separate advertising category. Advertising measurement is NOT currently switched on: while it is off, the banner shows no advertising choice at all, because there is nothing to choose. If we switch it on, the advertising option appears in the banner and nothing loads until you tick it. It is a different tick-box from analytics: agreeing to let us count page views is not agreeing to be measured for advertising, and we will not treat it as though it were.
This page previously said there were no advertising pixels on this site, and promised to say so here before that changed. This is that notice.
Declining costs you nothing. Every part of the site works either way, and we do not show you different prices or different content based on it.
What our server would report to Meta
The service is built to be able to report a small number of things that happen after a business signs up - a submitted lead, a verified sign-in, a paid subscription, a QR-pack order - from our server directly to Meta, so we could tell which advertising leads to real customers. This server-side reporting is part of the same advertising measurement described above, and it is off with it: it only operates if we switch advertising measurement on and configure it, and it obeys the same advertising choice as the pixel. No advertising consent, or nothing configured - and today nothing is configured - means nothing is sent to Meta from our server at all.
If we switch it on, a report would set nothing on your device. What would go with it: the event, the amount where there is one, the page it happened on, the plan or order id where there is one, Meta's own advertising cookies (_fbp, _fbc) where your browser already has them from accepting the pixel, and - when the request comes from a browser - the network address and browser it came from. What would never go with it: your name, your email address, your phone number, or anything about the individual customers of a business.
Set only if you accept advertising
These apply only when advertising measurement is switched on for the site (see above - it currently is not). When it is on, accepting the advertising category loads the Meta pixel, which sets two cookies of its own. Decline - or while advertising stays off - and the pixel never loads, so neither is ever set.
| Cookie | What it does |
|---|---|
| _fbp | Meta's own identifier for this browser. Lets Meta recognise that someone who clicked one of our ads later reached the site. |
| _fbc | Records which ad click brought you here, taken from the link you arrived on. |
Changing your mind
Use the Cookie settings link in the footer to change your choice at any time - the two categories are separate, so you can accept one and refuse the other. Clearing your browser's storage for this site also resets it, and you will be asked again.
In the app
https://app.thecococard.com runs the same consent-gated Google Analytics as the marketing site - nothing loads until you accept the analytics category, the app asks for and stores its own choice (a choice made on the marketing site does not carry over), and in the app we record the screen path only, never the query string. There is no advertising tracking inside the app: no pixel, and no advertising cookies.