Cookie Policy

This Cookie Policy explains how Towsty uses cookies and similar technologies when you use our website and portals. It should be read alongside our Privacy Notice.

What are cookies?

Cookies are small text files stored on your device. They can make a website work, keep you signed in, remember your choices, and — where you consent — help measure advertising and understand how people use the site. Similar technologies, such as pixels and browser storage, can perform related functions.

How we use cookies and browser storage

We use cookies and browser storage for the purposes described below. Some are strictly necessary and do not require consent. We ask for your consent before loading Google Ads, Meta Pixel, and Hotjar, and before Sentry records a session replay. An embedded Google Map loads only when you ask for it, or when you have accepted optional cookies. You can use Towsty if you reject those services.

Strictly necessary cookies

These cookies and identifiers are set by Towsty, our authentication provider Supabase, or Stripe, which provides installer identity-verification and payment services:

For current details about Stripe's technologies, see Stripe's Cookie Policy.

Optional advertising and behaviour-analytics technologies

If you select Accept all, we load the third-party services below. If you select Reject non-essential, we do not load them.

For more detail, see Google's advertising cookie information, Meta's Cookie Policy, and Hotjar's cookie list.

Advertising data we send to Google and Meta

If you choose Accept all and later save your estimate by email, we send Google a one-way hash derived from your email address. If you choose Accept all and later ask us to contact installers, we send Google and Meta one-way hashes derived from your email address and phone number. They use these to help connect your saved estimate or enquiry to an advert. Your readable email address and phone number are not included in this advertising data.

We may also tell Google and Meta when your enquiry is claimed, contacted, quoted or won. When you first submit the enquiry, Meta also receives your IP address, browser information and the page you used.

We do not send your name, address, postcode, property details, estimate, grant information or quoted price.

Embedded Google Maps

During the heat-pump assessment, we show the property you selected on an embedded Google Map. The map does not load on its own. In its place we show a short explanation and a Show map button, and your browser contacts Google only when you select that button, or when your recorded choice is Accept all. If you have accepted optional cookies, each map loads as soon as it appears on screen; if you accept part-way through the assessment, a map already on screen loads straight away, without a further click and without reloading the page. Until one of those happens, nothing is requested from Google, and Google cannot read or set cookies on your device through the map.

Selecting Show map is a choice about maps, not a change to your cookie choice: we do not record it in a cookie or in browser storage, and it is available whether or not you accepted optional cookies. Because the assessment shows a map on more than one step, we hold the choice in the page for the rest of your visit in that tab, so we do not ask you again each time. It ends when you close or reload the tab, and it does not carry over to another tab or to your next visit.

Your cookie choice takes priority over it. If you select Reject non-essential, or withdraw consent you had already given, any map on screen closes immediately, the Show map choice is forgotten, and the next map in the assessment asks you again.

A cookie choice reaches every Towsty tab you have open, not only the one you made it in. Withdrawing closes the maps in your other tabs as well; accepting opens a map that was waiting behind the placeholder in them. Those tabs change in place and are not reloaded. A few browsers cannot pass this signal between tabs. In those, a tab that was already open keeps showing what it was showing until you reload it, and the tab you made the choice in behaves exactly as described above.

When the map does load, your browser connects directly to Google and sends the selected property address or coordinates in the map request, together with technical information such as your IP address, browser information, and the Towsty page displaying the map. Depending on your browser and Google settings, Google may read existing Google cookies and set or update cookies and similar identifiers for functionality, security, analytics, personalisation, and advertising. Durations vary: for example, Google states that NID lasts for six months, while __Secure-ENID and SOCS last for 13 months. You can block or remove Google cookies in your browser, although the map may then work differently.

See Google's information about cookies and Google's Privacy Policy.

Cookieless service analytics

We also use Vercel Web Analytics and Speed Insights to understand website usage, journey performance, and technical performance. Towsty sends Vercel page views and custom events about assessment and installer-journey steps and outcomes. Event details can include a full postcode, an internal assessment identifier, campaign parameters, and a Google click identifier. We do not send names, email addresses, or phone numbers in these events.

These services do not set cookies. Vercel Web Analytics distinguishes daily visitors using a hash that resets each day and cannot be used to track a person across websites. Because these services do not store or read optional cookies on your device, they are not controlled by the cookie choice above.

Service analytics and experimentation

We use Statsig to test which version of a page works better — for example, comparing two designs of our homepage. While such a test runs, your browser is assigned to one version, and we record how far you progress through the heat-pump assessment journey (such as viewing the homepage, searching a postcode, or completing an estimate), together with the version you saw, your property's country, and UTM campaign parameters. We do not send your postcode, name, email address, or phone number to Statsig, and we never send advertising click identifiers (such as gclid).

To keep you on the same version between visits, we set a first-party cookie, towsty_statsig_id, holding a random identifier with no personal meaning. It lasts 365 days, is accessible only to our servers (not to scripts on the page), and does not follow you to other websites. Because it is anonymous and exists only to measure and improve our own service — never for advertising — it is not controlled by the cookie choice above, in line with how Vercel Analytics and Sentry already operate on Towsty. See Statsig's Privacy Policy.

First-party session storage

Towsty uses browser session storage in the current tab to keep journeys working and avoid duplicate events. This includes:

• towsty_acquisition_attribution and towsty_homeowner_acquisition_attribution — retain campaign parameters, including UTM values and Google and Meta ad click identifiers, and the domain of the website that referred you (never the page address), so an enquiry or installer application can be attributed to its source;
• towsty_installer_join_started and towsty_installer_join_step_viewed:* — avoid recording duplicate installer-journey events;
• towsty_fb_event_sent:* and towsty_ads_event_sent:* — avoid sending a duplicate Meta Pixel or Google Ads event (such as starting an assessment) more than once per visit;
• towsty_exp_exposed_* — avoids recording duplicate experiment-exposure events while a page test is running;
• towsty_ads_events_pending, towsty_ads_installer_apply_pending, and towsty_fb_events_pending — hold a pending conversion marker until the relevant advertising service is permitted; and
• towsty:pending-lead-purchase — resumes an installer payment after authentication.

Pending conversion and payment markers are removed when they are used. Choosing Reject non-essential deletes the Meta Pixel pending queue in the tab where you choose and in other open tabs that receive the decision, so a later Accept does not send events recorded before that rejection. The same choice deletes the once-per-visit Meta dedupe keys. Accept does not read those keys. They only stop the same event name being recorded again in this tab, and deleting them lets a later recording through. Attribution, installer-journey and Google Ads dedupe keys remain until you close the browser tab.

Error monitoring and session replay

We use Sentry to detect technical errors and monitor performance. This runs whatever your cookie choice, because it keeps the site working and lets us find and fix faults. When something goes wrong, it sends technical details about the fault, such as the error message and where in the site it happened. It also sends performance information from every visit, not only from visits where something goes wrong: which Towsty pages you moved between, the requests those pages made, how long each step took, and messages our code writes to the browser's developer console. None of this is a recording of your screen.

Sentry can also record session replays — a reconstruction of the pages you saw and what you did on them — and that part is optional. Replay recording starts only if you select Accept all, and then only for a sample of ordinary sessions and for sessions in which an error occurs. If you have not made a choice, or you select Reject non-essential, replay recording never starts. If you accept part-way through a visit, recording begins from that point and the earlier part of the visit is not recorded. If you withdraw consent, recording stops immediately and the replay state stored in your browser is removed.

A cookie choice reaches your other open Towsty tabs here too: they start or stop recording in place, and are not reloaded. A few browsers cannot pass this signal between tabs. In those, a tab that was already open carries on as it was until you reload it, and when it next loads a replay session whose consent has lapsed is discarded.

What happens to a recording already under way depends on which kind it was. If your session was one of those being recorded, the part recorded up to that moment is sent to Sentry as the recording closes: withdrawing stops any further recording, it does not retract what was recorded before it. If the recorder was instead holding only the most recent minute or so in your browser's memory in case an error occurred, and no error did, that is discarded without being sent.

While replay is recording, Sentry uses sentryReplaySession in browser session storage to maintain replay state in the current tab. Recording pauses after five minutes without activity. The replay session expires after 15 minutes without activity, after a maximum of 60 minutes, or when the tab is closed. See Sentry's Privacy Policy.

How to change your mind

You can change or withdraw your consent at any time. Select Manage cookies in the website footer where it is shown, or Manage cookie preferences on this page when optional cookies are offered, then choose Accept all or Reject non-essential again.

If you withdraw consent, Towsty records your choice as “denied”, stops loading the optional services, and refreshes the page you are on where needed. Cookies already stored on your device may remain until they expire or you remove them using your browser settings, but Towsty will not load the optional services to read or update them.

In the tab where you make the choice, withdrawal takes effect in full and at once: we tell Google Ads to stop using advertising cookies and identifiers and the Meta Pixel to stop sending further activity to Meta, we stop sending Google and Meta any further updates about an enquiry you made in this browser (or, if you are signed in, any of your enquiries), any embedded Google Map closes, and session replay stops. If that tab was already running the optional services — because you accepted in it earlier, or opened it with your consent already recorded — we also reload the page, and that reload is what ends Hotjar in it.

Your other open Towsty tabs follow, with one exception we would rather state plainly than leave you to discover. In them, an embedded Google Map on screen closes, a Sentry session replay stops recording, and we tell Google Ads to stop using advertising cookies and identifiers and the Meta Pixel to stop sending further activity to Meta. All of that happens straight away, in place, without those tabs reloading.

Hotjar is the exception. Where it was already running in one of your other tabs, it keeps recording there until that tab loads a page afresh — you reload it, follow a link away from Towsty, or close it. Moving between Towsty pages in that tab is not enough on its own, because those moves update the page in place rather than loading it again. The reason is a limitation we did not choose but have to live with: Google Ads and the Meta Pixel each offer a way to withdraw consent inside a page that has already loaded them, and Hotjar offers us no equivalent, so reloading is the only thing that ends a recording it has started. We reload the tab you are looking at, because you asked us to change something in it. We do not reload the others — taking a page out from under you in a tab you did not touch, losing whatever you had typed into an assessment there, is a worse thing to do to you than the delay — and that is a deliberate choice, not an oversight. If you would rather Hotjar stopped everywhere at once, reload or close your other Towsty tabs after withdrawing.

The same boundary applies when you accept. Your other open tabs load Google Ads and the Meta Pixel, open a map that was waiting behind the placeholder, and may begin a session replay, all without reloading; they do not start Hotjar until they next load a page.

If you withdraw your consent, we will delete the advertising identifiers we hold for your enquiry and stop sending further updates to Google and Meta. Information already sent to them cannot be retrieved.

If you withdraw consent from another device while signed out, please contact box.correla.privacy@correla.com so we can identify your enquiry.

If neither control is shown, optional cookies are not enabled in that environment.

Changes to this policy

We may update this Cookie Policy when our use of cookies or service providers changes. We will update the date shown at the top of this page when we make material changes.

More information

For information about how we use personal data and your rights, see our Privacy Notice.