Cookie Policy

Questions about any of this: connor@heoka.co.uk. See also the privacy policy.

Heoka Partners Limited, company 16516554. Last updated: 8 October 2026

The short version

We use a small number of cookies and browser storage entries. Some are set before you answer the cookie banner. This page lists them all, including the ones that should not be there yet. It was written from the site's code and from a test on 8 October 2026 in a fresh browser, checking what was stored before a choice, after Accept and after Decline.

Your choice

The banner on heoka.co.uk has two buttons.

  • Accept switches on PostHog page counting and lets Google's Ads tag set its cookies.
  • Decline keeps both off.

Your choice is kept in your browser (cookie-consent). To change your mind, clear the cookies and site data for heoka.co.uk in your browser settings and the banner will ask again.

The law (the Privacy and Electronic Communications Regulations) lets us set a cookie without asking only if it is strictly necessary. Counting visits and advertising are not, which is why PostHog and Google wait for Accept. The first-party visit record in the next section is the one thing we have not yet put behind the banner.

Set before you choose

  • hx_vid, hx_first, hx_reg (us, browser local storage, no expiry): a random visitor id, the campaign tags and referrer from your first visit (including a Google click id if you came from a Search ad), and a flag saying the id has been recorded. We use them to count visits and to match an enquiry or a purchase to the advert that brought you. Page views and events recorded with this id are stored in Supabase. The banner does not switch this off.
  • __stripe_mid (Stripe, cookie, 1 year) and __stripe_sid (Stripe, cookie, 30 minutes): Stripe's fraud-prevention cookies. Stripe's script loads on every page of the site, and also sets a cookie called m on its own domain, m.stripe.com.
  • __cf_bm (Cloudflare, cookie, 30 minutes): bot protection.
  • __dpl (our hosting platform, cookie, about 7 days): set by the host. We believe it records which release of the site you were served, but we have not confirmed that with the host.
  • A visit counter from our hosting platform loads from /~flock.js on every page. Its code can set a cookie called session-id for 30 minutes and send visit and page-speed events to a service called Tinybird. In our test it did neither. It is not part of our own code, so we cannot switch it off from here.
  • Script files from Google and PostHog load on every page. Before you tap Accept, PostHog is set to capture nothing and store nothing, and Google's tag is told to store nothing. Both companies still receive the request for the file, and Google's tag sends a small ping that sets no cookie.

Set only after you tap Accept

  • ph_phc_…_posthog (PostHog, cookie, 1 year, with matching local and session storage entries) and __ph_opt_in_out_… (local storage, records your choice): PostHog (EU) page counting.
  • _gcl_au (Google, cookie, about 90 days), _gcl_ls (local storage) and test_cookie (doubleclick.net, 15 minutes): Google Ads measurement and remarketing.

After Decline, none of these are set. The only change is that cookie-consent reads "declined" and PostHog records that you opted out.

Other entries on heoka.co.uk

  • cookie-consent (local storage): your banner choice.
  • heoka_ai_model (local storage): which AI model the site assistant uses, if you changed it.
  • heoka-entered (session storage, gone when you close the tab): remembers you have seen the opening screen.
  • Supabase sign-in storage (local storage): only if you sign in on the /auth page, which is meant for staff. Ordinary visitors do not get one.
  • Stripe, Google Calendar and WhatsApp set their own cookies on their own pages when you go there to pay, book a call or message us. Their policies apply.

Inside the Harness app (api.heoka.co.uk)

  • hc_session (cookie, HttpOnly, SameSite Lax): keeps you signed in.
  • hc_oauth (cookie, 10 minutes): used while you connect an account.
  • Display settings (local storage): your light, dark and accent choices.
  • PostHog (EU), once you are signed in: counts screens and clicks with your account id, role and company name, and stores an identifier in local storage and a cookie. The app does not ask first. It honours Do Not Track and never sends email addresses or the text of drafts.

What we will change

We will update this page when any of the above changes. Questions, or to ask us to delete what we hold about you: connor@heoka.co.uk.