1. What cookies are

Cookies are small text files that a website stores in your browser. Similar technologies, such as the browser’s local and session storage, work in much the same way, and this policy covers all of them. Under the Privacy and Electronic Communications Regulations (PECR), a website must ask for your consent before storing anything on your device, unless it is strictly necessary to provide a service you have asked for.

2. This website

cubesites.co.uk sets no cookies unless you allow analytics. It carries no advertising, retargeting or social media tags, no session recording, and no embedded content from other sites that could set cookies of its own. Fonts, icons and images are served from our own servers.

When analytics is in use, a banner asks on your first visit whether to allow it. “Essential only” keeps the site free of cookies. “Accept” lets Google Analytics set the _ga and _ga_<container-id> cookies. This is everything the website can store in your browser:

What this website can store in your browser
Name	Type	Purpose	Duration
`cookie_consent`	Local storage. Remembers your choice	Records whether you chose “Accept” or “Essential only”, so the banner does not ask again on every page. Written only when you choose.	Until you clear it
`visit_journey`	Session storage. Only sent if you enquire	Notes the page you arrived on and when, the site that sent you, any campaign tags and ad click IDs in that first link, the previous page and how many pages you have viewed. It stays in this tab and only reaches us if you send the enquiry form.	Until you close the tab
`_ga`	Cookie. Analytics, only if you allow it	Set by Google Analytics to tell one visitor from another, so that visits are counted rather than page loads.	Two years
`_ga_<container-id>`	Cookie. Analytics, only if you allow it	Set by Google Analytics to keep the state of your visit, such as when it started and how many pages you have viewed.	Two years

cookie_consent and visit_journey are kept in your browser’s storage rather than set as cookies, so they are not sent to us as you browse. The note in visit_journey is only sent if you submit the enquiry form, as described in our privacy policy.

3. Google Analytics

We use Google Analytics 4 to see which pages are useful and how people find the site. It is provided by Google Ireland Limited, with Google LLC, and it runs only if you allow it.

The Google Analytics script only loads after you allow analytics. If you choose “Essential only”, nothing is sent to Google.
_ga tells one visitor from another and _ga_<container-id> keeps the state of your visit. Both last two years unless you delete them.
GA4 does not log or store IP addresses.
Advertising features are off. The site tells Google not to use advertising storage, not to use your data for advertising and not to personalise ads.
Google may process the data in the United States, under the UK Extension to the EU-US Data Privacy Framework.
We keep analytics data for up to 14 months.

Google explains how it uses information from websites that use its services at policies.google.com/technologies/partner-sites.

4. The CubeSites application

When you sign in to CubeSites, the application stores the following. It is not used for analytics or advertising, and it is not shared with anyone else.

What the CubeSites application stores
Name	Type	Purpose	Duration
`cubesites_session`	Cookie. Strictly necessary	Keeps you signed in to CubeSites, so the application knows it is you from one page to the next. Never used for analytics or advertising.	Until you sign out, or 30 days
`cf.*`	Local storage. Strictly necessary	Remembers, on this device only, the workspace you last opened, items you opened and searched for recently, and how you like your views laid out.	Until you clear it
`Notices and export links`	Session storage. Strictly necessary	Notes which notices you have hidden, and holds the download link of an export you asked for, until you close the tab.	Until you close the tab

Because it is strictly necessary to provide the service you signed in for, PECR does not require consent for it.

5. The CubeSites phone app

The phone app sets no cookies at all. To keep you signed in, to open quickly and to work on a poor signal, it stores the following on the phone, and nothing else:

What the CubeSites phone app stores on your phone
Name	Type	Purpose	Duration
`cubesites_auth_token`	Secure storage. Strictly necessary	Keeps you signed in to CubeSites, so the app does not ask for your password every time it is opened. Held in the iOS keychain or Android Keystore, which other apps cannot read.	Until you sign out
`cubesites_installation_id`	Secure storage. Strictly necessary	A random identifier for this installation of the app, so the API can tell one phone from another. It is not a person or a device serial number, and it is not used for advertising.	Until you uninstall the app
`cubesites_user, cubesites_workspaces, cubesites_selection`	Secure storage. Strictly necessary	The signed-in person, their workspaces, and the website the app was last pointed at, so the app opens on the same place you left it.	Until you sign out
`cubesites_theme_preference, cubesites_push_enabled, cubesites_notify_prefs`	Secure storage. Strictly necessary	Your light or dark choice, whether notifications are allowed, and which kinds of notification you want. Nothing is sent anywhere.	Until you sign out
`cubesites_app_lock`	Secure storage. Strictly necessary	Records whether the app lock is switched on. The face, fingerprint or passcode check itself is done by the phone, and we never receive it.	Until you sign out
`cubesites_widget`	Secure storage. Strictly necessary	The figures the home screen widget shows: the website name, new enquiries, visits this week, and the name and time of the latest enquiry. Kept so the widget still has something to show when the phone is offline.	Until it is refreshed, you sign out or uninstall the app
`query-cache`	Local storage. Strictly necessary	Copies of enquiries, pages and figures the app has already loaded, so screens open instantly and keep working on a poor signal. Not used for analytics or advertising.	Until you sign out, or seven days

It all stays inside the app’s own space, which other apps cannot read, and the session token goes to the phone’s secure storage rather than ordinary storage. Uninstalling the app removes everything.

6. Websites built with CubeSites

Websites that our customers publish with CubeSites, on a cubesites.site address or their own domain, set no cookies of their own. Each one belongs to the business that publishes it, which decides what it shows and is responsible for its own cookie notice and privacy notice. This is everything the CubeSites code on those websites can store in a visitor’s browser:

What websites built with CubeSites can store
Name	Type	Purpose	Duration
`cs-cart`	Local storage. Strictly necessary	The basket on a website with a shop: each product’s name, option, price, picture, address and quantity, so the basket stays the same from page to page and between visits.	Until an order is placed, or the visitor clears it
`cs-cart-codes, cs-cart-code`	Local storage. Strictly necessary	Up to five discount codes the visitor entered for the basket. A single code kept by an older version of the page is moved into the list.	Until an order is placed, or the visitor clears it
`cs-checkout`	Session storage. Strictly necessary	What the buyer has typed on the checkout page (email address, name, phone number, address, note and delivery choice), so it is not lost if they go back to the basket. It is sent to the website only when they place the order.	Until the order is placed, or the tab is closed
`cs-cart-done`	Local storage. Strictly necessary	The reference of the last order finished in this browser, so the basket is emptied once after that order and not again.	Until the visitor clears it
`cs-cart-key`	Local storage. Shop statistics	A random key for the basket, made when the first item goes in and sent with basket and checkout requests, so the shop can count baskets and see which are left behind. The website stores only a hashed form of it, with the basket’s contents and value, the type of device and the first page of the visit, never a name, email address or IP address. If the visitor places an order, the basket record is linked to that order.	Until an order is placed (the next basket gets a new key), or the visitor clears it
`cs-entry-path`	Session storage. Shop statistics	The address of the first page of the visit, without any query string. On a website with a shop it is sent with basket requests so the shop can see where baskets start; otherwise it is never sent.	Until the tab is closed
`cs-viewed`	Local storage. Functional	Up to 12 products the visitor has looked at on the website (name, address, picture and price), to show a “recently viewed” shelf on product pages. It is never sent to the website or to anyone else.	Until the visitor clears it
`cs-consent`	Local storage. Remembers the visitor’s choice	Records the choice made in the website’s cookie notice, if the owner shows one, so it is not asked again on every page. Analytics or advertising tags the owner has added load only after the visitor allows them.	Until the visitor clears it
`cs-announce-hidden, cs-demo-hidden`	Session storage. Remembers the visitor’s choice	Notes that the visitor closed the announcement bar, or the notice on a demo website, so it stays closed for the rest of the visit.	Until the tab is closed

The basket, discount codes, checkout details and the visitor’s own choices are strictly necessary to provide what the visitor asked for, so PECR does not require consent for them. The basket key and the first page of the visit are used for the shop’s statistics, and the recently viewed list for a shelf on product pages. These are not strictly necessary, and the owner of the website should describe them in its own cookie notice.

None of it is a cookie and none of it is used for advertising. The basket, codes, basket key, first page and checkout details are only ever sent to the website itself, when the visitor uses the basket or the checkout.

The visitor statistics website owners see in the app are counted on our server from each page request, without cookies or browser storage, and only daily totals are stored. Searches of a website’s product catalogue are also recorded on our server, without cookies or browser storage, as our privacy policy describes.

If the owner of a website adds analytics or advertising tags, such as Google Analytics, Google Tag Manager, the Meta Pixel, Plausible, Fathom or Cloudflare Web Analytics, they load only after the visitor allows them in the website’s cookie notice, and they may set cookies of their own. The owner decides whether to use them and should describe them in its notice.

Visitors can clear what a website has stored through their browser settings. Clearing it empties the basket.

7. Changing your choice

You can change your analytics choice at any time using the Cookie settings link in the footer of every page, which appears whenever analytics is in use. Choosing “Essential only” there withdraws your consent: it stops Google Analytics and removes the _ga cookies it has set.

You can also view, block and delete cookies in your browser settings. Blocking them does not stop this website working. It will stop you signing in to CubeSites, because the session cookie is how the application knows it is you.

General guidance on managing cookies is available from the Information Commissioner’s Office.

8. Changes to this policy

We will update this page, and the date at the top, before we change what this website, the application, the phone app or the CubeSites code on published websites stores on your device.

Cookie policy

The short version