Cookies & Analytics Policy
Introduction
This policy explains how HobbyTub Ltd ("we", "us", "our") uses cookies and similar technologies on our SAAS platform (https://www.hobbytub.com), and how we measure use of the platform without them.
We only use strictly necessary cookies. We do not use advertising cookies, tracking cookies or any analytics cookies, and we do not share your data with advertising networks. That is why you are not asked to accept cookies when you arrive.
We are committed to protecting your privacy and complying with applicable data protection laws worldwide, including the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant regulations.
What Are Cookies?
Cookies are small text files placed on your device (computer, smartphone, or other electronic device) when you access our website. Cookies allow us to recognize your device and maintain your login session as you navigate our platform.
Types of Cookies We Use
We use cookies in the following categories only:
- Strictly Necessary Cookies: Essential for authentication, security, maintaining your login session, and preventing payment fraud. These cookies enable you to securely log in, access your account and pay safely, and cannot be disabled.
- Preference Cookies: Remember a display choice you have made, such as light or dark mode. These are set only when you change the setting.
We do not set analytics or marketing cookies of any kind. Because we place nothing on your device that is not strictly necessary or a preference you chose, no cookie consent banner is required.
List of cookies used
| Cookie name | Purpose | Expiry | Type |
|---|---|---|---|
| hobbytub_session | Maintains user login session | 24 hours | Strictly Necessary |
| remember_* | Keeps you signed in between visits | 400 days | Strictly Necessary |
| XSRF-TOKEN | Site security | 24 hours | Strictly Necessary |
| appearance | Remembers your light or dark mode choice | 1 year | Preference |
| __stripe_mid | Payment fraud prevention, set by Stripe on our billing pages | 1 year | Strictly Necessary |
| __stripe_sid | Payment fraud prevention, set by Stripe on our billing pages | 30 minutes | Strictly Necessary |
| m (m.stripe.com) | Payment fraud prevention, set by Stripe on our billing pages | 400 days | Strictly Necessary |
The last three are set by Stripe, our payment processor, and only on the pages where you manage your plan or payment details. Stripe uses them to tell genuine customers from fraudulent ones, and classes them as necessary for that purpose. They are never used for advertising, and we do not receive any advertising data from them.
How We Measure Use of the Platform
To understand which parts of the platform people find useful, we use PostHog, a product analytics service, hosted on servers in the European Union. PostHog acts as our data processor and does not use your data for its own purposes.
We run it in a cookieless mode. This means that while you are signed out, no cookie, local storage entry or any other identifier is written to or read from your device. Instead, visits are counted using a temporary, privacy-preserving code that is calculated on the server and cannot be traced back to you. That code is regenerated daily and the information used to build it is discarded.
When you are signed in, we record activity against your account so we can understand how features are used across your devices. Even then, nothing analytics-related is stored on your device.
We do not record your screen, use session replay, track you across other websites, build advertising profiles, or sell your data. Analytics requests are sent through our own domain so that they behave as first-party requests.
Legal Basis
Under PECR and the ePrivacy Directive, consent is required to store information on, or gain access to information stored on, your device. Strictly necessary cookies are exempt because they are essential to provide the service you requested. Our analytics does not store or access anything on your device at all, so these rules do not apply to it.
The limited processing that analytics does involve is carried out under our legitimate interests in understanding and improving our own service. We have balanced this against your rights by not storing device identifiers, not profiling, not advertising, and giving you the controls described below.
Your Choices
- Global Privacy Control / Do Not Track: If your browser sends either of these signals, we honour it automatically and our analytics is never loaded. You do not need to do anything else.
- Account setting: If you have an account, you can turn analytics off entirely under Settings → Privacy. This applies to your account on every device, including measurement carried out on our servers.
- Browser settings: You may block or delete cookies via your browser, but doing so may prevent you from logging in or accessing your account, as strictly necessary cookies cannot be disabled.
International Users
We comply with relevant data protection and privacy laws in all jurisdictions where our users are located, including but not limited to the United Kingdom, European Union, United States, Canada, and other countries. Our analytics data is stored in the European Union.
Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website.
Contact Us
- By email: [email protected]
By using our platform, you acknowledge that strictly necessary cookies will be placed on your device to enable login and session management.