Cookie Policy

This Cookie Policy explains how Retavu uses cookies and similar technologies — on our website, on the booking sites we run for businesses, and in our phone app. It should be read alongside our Privacy Policy.

1. What cookies are

Cookies are small text files stored on your device when you visit a website. They are widely used to make websites work, and to provide information to the site owner.

The law treats other kinds of storage on your device the same way, so this policy covers those too. Most of what we store is not a cookie at all — it is kept in your browser’s own storage, never sent to us, and readable only by this site on your device.

2. What we store, and why

The Privacy and Electronic Communications Regulations set out a short list of purposes for which something can be stored on your device without asking you first. Everything we store without asking falls under one of them, and each is named below so you can see which: strictly necessary for something you asked for, or appearance and functionality — remembering how you like things, which you can refuse (2a). The one thing we ask about first is in 2b. Nothing we store is used to track you, build a profile, or advertise to you.

On our website: cookies

• Sign-in cookies (set by our sign-in provider, Supabase, on our own website) — keep you signed in and protect your session. They last up to 400 days, renewed while you use the site, and go when you sign out. Without them you could not log in, or stay logged in. Strictly necessary.
• Your way back to a review — when you open the tip page from a review, this keeps that review’s link (and those of up to two others you opened) so that, if you pay a tip on Stripe’s page, you’re brought back to your review. It is only ever sent to our tip pages, and is gone two hours after you last opened one. Strictly necessary.
• A website you were buying — if you start buying a website and have to sign up first, this remembers which one, so you’re brought back to it once your account is ready. It lasts up to 14 days. Strictly necessary.
• A note that you’re in our phone app — set when the app opens the website for you, so the pages the app isn’t allowed to show stay out of it. It lasts a year. Strictly necessary.
• Who referred you — only if you say yes; see 2b. Consent.

On our website: kept in your browser, never sent to us

• A note that you have seen our cookie message, and your answer if you were asked about a referral — so they stop appearing on every page. There is no way to remember your choice without remembering something. Strictly necessary.
• Work you haven’t saved yet — website edits and email drafts, kept on your device for up to 14 days so a lost connection doesn’t lose them, and the list of customers you picked to email, until you close the tab. Strictly necessary.
• If you turn on notifications, a small background script of ours that shows them, and the subscription your browser’s push service gave it. They go when you turn notifications off. Strictly necessary.
• Your light or dark appearance setting — stored only if you choose dark, so the dashboard looks the way you left it. Appearance.
• How far you got through a guided tour — so a walkthrough you have already finished does not start again from the beginning. Functionality.
• Your notification choices, and whether you have hidden the reminders to turn notifications on or to get the app — so your choices survive signing out and back in, and the reminders stay hidden. Functionality.

On a business’s booking site

• No cookies at all.
• Your shopping basket on a business’s shop — kept in your browser so the items you picked survive a page refresh. Cleared once your order goes through. Strictly necessary.
• While you pay, a one-off code for that attempt, kept until you close the tab, so a payment you abandon gives its time slot back. Strictly necessary.

In our phone app

• Your sign-in, kept in your phone’s secure keychain until you sign out. Strictly necessary.
• Website edits you haven’t saved yet, for up to 14 days. Strictly necessary.
• An identifier for your copy of the app, which it sends to Expo — the service that delivers the app’s updates — whenever it checks for one. Strictly necessary.
• If you allow notifications, a token for your phone from Expo, which delivers them. Strictly necessary.
• Your appearance setting and your notification choices, and whether the app has already asked you about notifications. Appearance and functionality.

2a. Saying no to the appearance and functionality ones

The appearance and functionality items rely on an exception that comes with a condition: you must have a simple and free way to say no. You do.

• The appearance setting is only ever stored if you choose dark. Leave it alone and nothing is written; switch back to light and the stored value goes with it.
• Dismissing the guided tour stops it being tracked. You can also close it at any point and it will not follow you.
• Clearing your browser data for this site removes all of it — at the cost of signing you out. In the phone app, signing out and deleting the app does the same.
• The record that you have finished a guided tour is also kept against your account, so clearing your browser would not reach it. Ask us at Contact address not published yet and we will clear that. Your appearance setting and notification choices are only ever held on your own device, so there is nothing on our side to clear.

We do not use analytics, advertising, or third-party tracking cookies anywhere, and there is no third-party monitoring or session recording in the product or the app. We don’t track whether you open our emails or click their links. When you pay, you are taken to Stripe, which sets its own cookies on its own pages to process the payment securely and prevent fraud; those are governed by Stripe’s cookie and privacy notices.

If a business’s booking site shows an embedded video, the only thing fetched from YouTube before you press play is the video’s preview picture, from YouTube’s image server — which, like any website you load something from, receives your IP address and browser details. The player itself loads only when you press play, from YouTube’s privacy-enhanced service (youtube-nocookie.com), and YouTube may then store its own cookies or similar data to play the video; those are governed by Google’s privacy policy.

2b. The one we ask about: who referred you

If you arrive through someone’s referral link, we keep that link’s code in the page while you look round, so they’re credited if you sign up during that visit. Nothing is stored on your device for that.

To remember it beyond the visit, we ask first. Only if you choose “Remember it” do we keep the code in one cookie for 12 months, so the person who referred you is credited if you sign up later. It holds that code and nothing else, is only read when you sign up, and a newer referral link you follow replaces it. Say “No thanks” and nothing is stored except your answer. Consent.

You can take it back at any time:

Forget who referred me

3. If this changes

If in future we introduce other non-essential cookies (for example, analytics), we will update this policy and ask for your consent before setting them, in line with UK law.

4. Managing cookies

You can control and delete cookies through your browser settings. Blocking our essential cookies will stop you from being able to sign in and use the Service.

5. The technical names

For anyone who wants to check them in their browser — “…” stands for a part that differs from person to person:

• sb-…-auth-token (and .0, .1… if long), sb-…-auth-token-code-verifier — Cookie. Sign-in; up to 400 days.
• tip_back — Cookie (sent only to /tip pages). Way back to a review; 2 hours.
• pending_project — Cookie. A website you were buying; 14 days.
• tw_app — Cookie. Phone-app note; 1 year.
• retavu_ref — Cookie — only with consent. Who referred you; 12 months.
• twg_cookie_notice_ack, retavu_ref_choice — Browser storage. Cookie message seen; referral answer; until cleared.
• twg-editor-draft:…, twg-email-draft:… — Browser storage. Unsaved work; up to 14 days.
• email-these — Browser storage (this tab only). Customers picked to email; until the tab closes.
• tw-theme — Browser storage. Appearance (dark only); until changed back or cleared.
• tour-step:v4:… — Browser storage. Guided-tour position; until the tour is finished.
• twg-push-choice:…, twg-notif-banner-dismissed:…, twg-install-banner-snoozed-until — Browser storage. Notification choices; hidden reminders; until cleared.
• shop-cart:…, pending-checkout:… — Browser storage, on booking sites. Basket; payment attempt; until the order goes through; until the tab closes.

6. Contact

Questions about our use of cookies? Contact us at Contact address not published yet.