Cookie policy

A cookie is a small text file that a website stores on your device when you visit. Cookies do useful things - keep you logged in, remember your preferences - and can also be used for analytics or advertising.

UK and EU law treats cookies (and similar technologies like local storage) the same way: you must consent to non-essential ones before they're set, and rejecting them must be as easy as accepting them.

We split cookies into two categories: strictly necessary (no consent required - they're essential to the service) and non-essential (consent required before they fire).

2.1 Strictly necessary cookies

These cookies are essential. Disabling them would break core functionality (logging in, securing your session). We set them without asking - UK law (PECR 2003) permits this for cookies "strictly necessary for the provision of a service requested by the user."

Note: Supabase uses HttpOnly, Secure, SameSite=Lax cookies - they're not readable by JavaScript and only sent over HTTPS. We never store session tokens in localStorage.

2.1.1 Functional browser storage (first-party, no tracking)

When you use the signed-in app we also keep a small number of interface preferences and housekeeping values in your browser. They are set by TransportPlanAI only, hold no personal data beyond what is listed, are never sent to third parties and are not used for tracking or advertising. Most are written only in response to something you do; the two animation flags are written once so the brand intro does not replay.

2.2 Non-essential cookies - analytics

These fire only after you accept the analytics toggle in our cookie banner.

PostHog data is processed in the EU. We send: a randomly-generated PostHog user ID (linked to your TransportPlanAI user ID internally), page paths, button clicks, feature usage events. We do not send: prompt content, project content, AI conversation data.

2.3 Non-essential cookies - marketing

None. We don't run third-party advertising or set marketing cookies at this time. If that changes, this policy will be updated and you'll be re-prompted to consent.

2.4 Third-party embedded content

We don't embed third-party content (YouTube videos, Twitter widgets, Disqus comments, etc.) that would set their own cookies. If we ever do, this policy gets updated first and consent is required.

3.1 The cookie banner

The first time you visit, you'll see a banner with two clearly-presented choices:

• Accept all - turns on product analytics (PostHog).
• Reject analytics - only strictly-necessary storage is used; no analytics loads.

Both buttons share the same size, weight, and prominence - rejecting is exactly as easy as accepting, per UK / EU rules. We have a single non-essential category (analytics), so one button covers it; there's no separate "manage" step.

3.2 Changing your mind

Select Reset cookie preferences below. You can withdraw consent any time; analytics stops and its browser persistence is cleared immediately. The banner appears again on your next page load.

You can also reset your choice here - this clears the stored consent so the banner shows again on your next page load:

3.3 Browser-level controls

You can also use your browser's settings to block or delete cookies. Be aware that this may break the strictly-necessary ones (you won't be able to log in). Major browsers' instructions:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Safari: Preferences → Privacy
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Edge: Settings → Cookies and site permissions

3.4 Do Not Track

Some browsers send a "Do Not Track" header. The standard has no consistent legal meaning - we treat DNT as a request and honour it conservatively: we do not load non-essential cookies when DNT is on, regardless of your banner choice. Strictly-necessary cookies still fire (they have to).

3.5 Global Privacy Control (GPC)

Where your browser sends the GPC signal (globalprivacycontrol.org), we honour it as a do-not-sell / opt-out-of-targeted-advertising signal. We don't sell data and don't run targeted advertising, so the practical effect is the same as DNT - non-essential cookies don't fire.

Your consent decision is stored in your browser's local storage (tpai_cookie_consent) until you change it or clear your browser storage - it isn't sent to our servers. You can withdraw or change consent at any time per §3; doing so stops analytics and clears PostHog browser persistence immediately.

We'll update this page when we add, remove, or change cookies. Material changes (new analytics provider, new category of cookie) trigger a re-prompt of all users - we don't carry old consents forward to new processing.

We keep a dated version history of this policy, and will provide previous versions on request.

• General privacy enquiries: support@transportplanai.co.uk
• Data subject rights: see the Privacy Policy.