Cookie notice

What this website stores in your browser, and how to refuse it.

Last updated 2026-08-20 · Black Flame Digital Ltd

Analytics cookies are off until you say yes. We ask once, and refusing takes exactly as many clicks as accepting. Until you choose, nothing is stored for analytics. You can change your mind at the bottom of this page.

Cookies we set ourselves

tenth_cid — strictly necessary, 2 years: Set when you take a card. It is a random identifier for the browser, and it does two jobs: it lets that browser download its own card, and it means scanning the counter code a second time finds the card you already have rather than issuing another one. It holds no name and nothing about you. It is HttpOnly, so scripts on the page cannot read it. Without it the enrolment page cannot work, which is why it needs no consent.
sb-…-auth-token — strictly necessary, session: Only for shop accounts. Keeps you signed in to the dashboard and the till. Set by Supabase, our authentication provider.

Google Analytics — only if you agree

_ga, _ga_* — analytics, up to 2 years: Google Analytics 4. Counts visits and shows us which pages get used, so we know whether the enrolment page works. Set only after you accept. Set by Google; read Google’s own privacy information for what they do with it.

What happens before you choose, and if you refuse

Being straight about this, because “off” is doing some work in that sentence. The Analytics tag is on the page from the start, but it is told not to use storage — so it sets no cookies and reads none, and cannot recognise you or follow you between visits. It does still tell Google a page was viewed, without an identifier. Google calls this a cookieless ping.

We load it that way rather than withholding it entirely for an honest reason: it is the arrangement Google supports, and it means accepting takes effect immediately instead of on your next page. If you would rather nothing at all reached Google, block the domain googletagmanager.com — a tracker-blocking browser or extension does this by default. Nothing on this site needs Analytics to work, including taking a card.

If you accept and later refuse, we expire the _ga cookies rather than just stopping — withdrawing consent should undo something.

Live chat

Most pages carry a chat button in the bottom corner, run by Tawk.to. Being straight about the part that matters: it loads with the page, and sets its cookies then — not when you open a conversation. So they are set on a normal visit, whether or not you ever say anything.

__tawkuuid and related — live chat, up to 6 months: Identifies your browser to Tawk, so a reply reaches the right chat window and a conversation is still there if you come back. Tawk also receives the page you are on, your IP address, and anything you type into the chat. Read Tawk’s own privacy information for what they do with it.

Two places it is deliberately absent. It is not on the page a customer sees after scanning a shop’s counter code — that screen belongs to the shop, and a chat window there would reach us rather than them. And it is not on a shop’s till screen, which faces a queue. Chat is for shop owners talking to us.

It also waits until the cookie question above has been answered, so it cannot cover the buttons you would use to answer it. If you would rather it never loaded, a tracker-blocking browser or extension blocks tawk.to, and nothing on this site needs it to work.

Not cookies, but stored on your device

The till screen remembers which staff name was last selected, in that device’s local storage, so a cashier does not re-pick it every sale. It never leaves the device by itself.
Your card lives in Apple Wallet or Google Wallet, not in this website. Deleting cookies does not delete your card, and deleting your card does not delete these cookies.

Change your mind

Contact

support@tenthcards.co.uk