Cookie Policy
Last updated: July 2026
This Cookie Policy explains how Towsty uses cookies and similar technologies when you use our website and portals. It should be read alongside our Privacy Notice.
What are cookies?
Cookies are small text files stored on your device. They can make a website work, keep you signed in, remember your choices, and — where you consent — help measure advertising and understand how people use the site. Similar technologies, such as pixels and browser storage, can perform related functions.
How we use cookies and browser storage
We use cookies and browser storage for the purposes described below. Some are strictly necessary and do not require consent. We ask for your consent before loading Google Ads, Meta Pixel, and Hotjar. You can use Towsty if you reject those services.
Strictly necessary cookies
These cookies and identifiers are set by Towsty, our authentication provider Supabase, or Stripe, which provides installer identity-verification and payment services:
| Cookie | Purpose | Duration |
|---|---|---|
| towsty_cookie_consent | Records whether you accepted or rejected optional cookies, so we can respect your choice. | 365 days |
| towsty_session_id | Links your answers to your anonymous heat-pump estimate while you complete the assessment. | 24 hours |
| towsty_saved_estimate_token | Securely opens the saved estimate linked from your email. | 90 days |
| sb-<project-ref>-auth-token and sb-<project-ref>-auth-token-code-verifier (may be split into numbered cookies) | Maintains a secure signed-in session and completes passwordless sign-in through our authentication provider, Supabase. | Authentication cookies may remain for up to 400 days; the verification cookie is removed after sign-in completes |
Stripe fraud-prevention cookies and identifiers, including __stripe_mid and __stripe_sid |
Secures installer identity verification, card setup, and payments and helps Stripe detect and prevent fraud. | Typically one year for the device identifier and 30 minutes for the session identifier |
For current details about Stripe's technologies, see Stripe's Cookie Policy.
Optional advertising and behaviour-analytics technologies
If you select Accept all, we load the third-party services below. If you select Reject non-essential, we do not load them.
| Provider and technology | Purpose | Typical duration |
|---|---|---|
Google Ads_gcl_* cookies and _gcl_ls local storage |
Attributes visits and completed enquiries to advertising, measures campaign performance, and supports remarketing. | Cookies: up to 90 days. Local storage has no automatic browser expiry and remains until Google or you clear it |
Meta (Facebook) Pixel_fbp and, after an ad click, _fbc |
Measures page views and completed enquiries, and helps Meta attribute them to advertising. | Up to 90 days |
Hotjar_hjSessionUser_6743939, _hjSession_6743939, other _hj* cookies, and browser local/session storage such as hjActiveViewportIds and hjViewportId |
Produces heatmaps, session recordings, and surveys so we can understand and improve the website experience. | 30 minutes for a session; up to 365 days for the site-specific user identifier; session storage lasts for the current tab; local storage remains until Hotjar or you clear it; capability-test values are deleted almost immediately |
For more detail, see Google's advertising cookie information, Meta's Cookie Policy, and Hotjar's cookie list.
Embedded Google Maps
During the heat-pump assessment, we use an embedded Google Map to show the property you selected. When the map loads, your browser connects directly to Google and sends the selected property address or coordinates in the map request, together with technical information such as your IP address, browser information, and the Towsty page displaying the map.
Depending on your browser and Google settings, Google may read existing Google cookies and set or update cookies and similar identifiers for functionality, security, analytics, personalisation, and advertising. Durations vary: for example, Google states that NID lasts for six months, while _Secure-ENID and SOCS last for 13 months. The map is not controlled by Towsty's optional-cookie choice. You can block or remove Google cookies in your browser, although the map may then work differently.
See Google's information about cookies and Google's Privacy Policy.
Cookieless service analytics
We also use Vercel Web Analytics and Speed Insights to understand website usage, journey performance, and technical performance. Towsty sends Vercel page views and custom events about assessment and installer-journey steps and outcomes. Event details can include a full postcode, an internal assessment identifier, campaign parameters, and a Google click identifier. We do not send names, email addresses, or phone numbers in these events.
These services do not set cookies. Vercel Web Analytics distinguishes daily visitors using a hash that resets each day and cannot be used to track a person across websites. Because these services do not store or read optional cookies on your device, they are not controlled by the cookie choice above.
First-party session storage
Towsty uses browser session storage in the current tab to keep journeys working and avoid duplicate events. This includes:
towsty_acquisition_attributionandtowsty_homeowner_acquisition_attribution— retain campaign parameters, including UTM values and Google click identifiers, so an enquiry or installer application can be attributed to its source;towsty_installer_join_startedandtowsty_installer_join_step_viewed:*— avoid recording duplicate installer-journey events;towsty_ads_conversion_pending,towsty_ads_installer_apply_pending, andtowsty_fb_lead_pending— hold a pending conversion marker until the relevant advertising service is permitted; andtowsty:pending-lead-purchase— resumes an installer payment after authentication.
Pending conversion and payment markers are removed when they are used. Attribution and installer-journey dedupe keys remain until you close the browser tab.
Error monitoring and session replay
We use Sentry to detect technical errors, monitor performance, and sample session replays so we can diagnose problems. Sentry uses sentryReplaySession in browser session storage to maintain replay state in the current tab. Replay recording pauses after five minutes without activity. The replay session expires after 15 minutes without activity, after a maximum of 60 minutes, or when the tab is closed. Sentry is not controlled by the optional-cookie choice described above. See Sentry's Privacy Policy.
How to change your mind
You can change or withdraw your consent at any time. Select Manage cookies in the website footer where it is shown, or Manage cookie preferences on this page when optional cookies are offered, then choose Accept all or Reject non-essential again.
If you withdraw consent, Towsty records your choice as “denied”, stops loading the optional services, and refreshes the page where needed. Cookies already stored on your device may remain until they expire or you remove them using your browser settings, but Towsty will not load the optional services to read or update them.
If neither control is shown, optional cookies are not enabled in that environment.
Changes to this policy
We may update this Cookie Policy when our use of cookies or service providers changes. We will update the date shown at the top of this page when we make material changes.
More information
For information about how we use personal data and your rights, see our Privacy Notice.