Legal
Cookie Policy
Last updated: 2 August 2026
What this covers
UK PECR covers cookies and other technologies that store information on, or access information from, a device. Essential storage can operate without optional consent where a narrow legal exception applies. Optional analytics stays off unless you actively accept it.
Storage we use
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| sb-*-auth-token (including chunks) | Supabase | Essential | Keeps an authenticated account signed in and refreshes its session. | Session/provider controlled |
| __cf_bm / challenge storage | Cloudflare | Essential when set | Bot, abuse and security checks, including Turnstile challenges. | Provider controlled |
| tl_cookie_consent | TutorLab localStorage + cookie | Essential preference | Remembers accepted or declined analytics so the choice is respected by the browser and edge. | 1 year or until changed |
| tl_partner | TutorLab | Essential for a requested referral | Remembers a referral link so the named referral benefit can be applied at signup. | 30 days |
| tl_src / tl_camp | TutorLab | Optional analytics | Records bounded first-touch source and campaign values on signup pages only after analytics is accepted. | 30 days |
| tl_freetool_* | TutorLab browser storage | Essential for requested free tools | Enforces a short usage allowance and protects paid AI capacity from abuse. | 24 hours |
| _ga, _ga_*, _gid | Google Analytics | Optional analytics | Measures aggregate use after analytics is accepted. | Provider controlled, up to 2 years |
Cookieless first-party statistics
TutorLab sends a first-party pageview request to its own /api/hit endpoint. It does not write a cookie or browser-storage identifier. At the edge, IP address, user agent, host and UTC day are converted into a one-way daily pseudonymous hash; the analytics dataset stores the hash, day, host, coarse country and count, not the raw IP or user agent. Cloudflare Analytics Engine retains that dataset for up to three months. This is processed under legitimate interests for proportionate service measurement, subject to the objection right in the Privacy Policy.
Your choice
Accepting analytics loads Google Analytics, permits bounded signup-attribution storage, and switches on Microsoft Clarity session replay with sensitive input fields masked. Choosing essential only leaves all of those unloaded — nothing records without your consent. A child-data privacy assessment covering Clarity is on file. The service remains available either way. You can reopen the choice below; declining also removes accessible Google Analytics cookies where possible.
What we do not do
TutorLab does not use advertising pixels, retargeting cookies or cross-site advertising profiles. Campaign-attribution storage is written only after analytics consent. The referral cookie is set only when someone deliberately follows or enters a referral link so the requested referral benefit can work.
Contact and updates
Questions: harry@trytutorlab.uk. We update this page when storage or purposes change. See the Privacy Policy for data-protection rights.