DRAFT — pending legal review. This document is a first-pass working draft prepared for internal review only. It has not been reviewed or approved by a qualified lawyer and must not be published, linked from the live site, or relied upon as final until it has been. Bracketed placeholders mark facts (legal entity name, registered address, contact details) that could not be found in the codebase and must be supplied before publication.
Cookie Policy
Last updated: 9 September 2026
This Cookie Policy explains how coffee-on.me ("coffee-on.me," "we," "us," or "the Company") uses cookies and similar technologies when you visit our website at coffee-on.me or use our application (together, the "Service"). It should be read alongside our Privacy Policy, which explains more broadly how we collect and use personal data.
The Company is the operator of coffee-on.me. [The Company's registered legal name, company number, and registered address will be inserted here once confirmed.]
1. Our approach, in short
coffee-on.me does not use cookies for analytics, advertising, or tracking, on any part of the Service, today. We use a small number of strictly necessary cookies whose only purpose is to keep you securely signed in and to remember that you've verified your identity, so that our website and application work at all. We do not currently load any third-party analytics, advertising, or social-media scripts, and we do not use a cookie-consent banner because, at present, every cookie we set falls within the "strictly necessary" exemption under UK and EU cookie law (see Section 5).
If that ever changes — for example, if we introduce analytics or marketing cookies in the future — we will update this policy first and put a cookie-consent mechanism in place before any non-essential cookie is set. We describe what that would look like in Section 6 so you know what to expect.
2. What are cookies?
Cookies are small text files that a website or application stores on your device (computer, phone, or tablet) when you visit it. They allow a site to recognise your device across page loads and visits — for example, to keep you logged in, or to remember a choice you made.
Cookies can be:
- Session cookies, which are deleted automatically when you close your browser.
- Persistent cookies, which remain on your device for a set period or until you delete them.
- First-party cookies, set directly by the site you are visiting.
- Third-party cookies, set by a domain other than the one you are visiting (for example, by an embedded analytics or advertising script).
This policy also covers similar technologies that work in a comparable way, such as local storage, where relevant.
3. Where cookies are, and aren't, used across coffee-on.me
The Service has two distinct parts, and they are not treated the same way:
3.1 The public marketing website
The public marketing pages of coffee-on.me — the pages you can read without signing in or verifying your identity — set no cookies at all. They load no analytics, advertising, or tracking scripts of any kind (no Google Analytics, no advertising pixels, no social-media widgets, no session-replay or heatmap tools, and no A/B-testing scripts). There is currently no cookie-consent banner on these pages, because there is nothing on them that requires one.
3.2 Public share-link pages
coffee-on.me lets a recruiter share a private, link-based conversation with a candidate or client (a "share link"). The public-facing pages a recipient sees before they verify their identity likewise set no cookies and use no local storage or analytics of any kind.
3.3 The signed-in application and verified conversations
Once you sign in to coffee-on.me (as a recruiter using the application) or verify your identity to open a private conversation (as a candidate or client responding to a share link), a small number of strictly necessary cookies are used to keep that session working. These are described in Section 4 below. They exist purely to run the Service securely — none of them are used to track you across other websites, build an advertising profile, or measure marketing performance.
4. Strictly necessary cookies we use
These cookies cannot be switched off in our systems because the Service cannot function securely without them — for example, we could not keep you signed in, or keep a verified conversation private to you, without them. Under UK and EU cookie law, cookies of this kind do not require your consent because they are strictly necessary to provide a service you have explicitly requested (see Section 5).
| Purpose | What it does | Who it applies to |
|---|---|---|
| Recruiter sign-in and session | Keeps a recruiter authenticated to their workspace across page loads, so they are not asked to sign in again on every request. | Recruiters signed in to the application. |
| Candidate/client portal session | Keeps a candidate or client signed in to their own private conversation portal after they have verified their identity. | Candidates and clients who have signed in to their portal. |
| Share-link identity verification | Remembers, for the duration of a session, that a visitor to a private share-link conversation has completed identity verification (for example, by confirming a one-time code sent to their email or phone), so they are not asked to reverify on every request within that conversation. | Candidates and clients who have verified their identity via a share link. |
These are all first-party cookies, set directly by coffee-on.me. None of them are set by, or shared with, third-party analytics or advertising providers. We do not currently maintain a table of individual cookie names, exact expiry periods, or domains for this draft; that technical detail will be added to the published version of this policy once confirmed against the live environment.
5. Cookies we do not use
For clarity, and because a policy that describes cookie categories a site doesn't actually use is worse than no policy at all, we want to be specific about what is not present on coffee-on.me today:
- No analytics or performance cookies — we do not use Google Analytics, Plausible, Amplitude, or any comparable analytics tool.
- No advertising or targeting cookies — we do not run advertising pixels (for example, a Meta/Facebook Pixel), retargeting tags, or ad-network cookies.
- No social-media cookies — we do not embed social-media widgets or share buttons that set their own cookies.
- No session-recording or heatmap tools — we do not use tools like Hotjar or Microsoft Clarity.
- No cross-site tracking of any kind.
If any of this changes, we will update this section — and put the appropriate consent mechanism in place — before it does, not after.
6. Legal basis and consent
Under the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive (as implemented in EU member states), storing or accessing information on your device generally requires either your consent or that the cookie is "strictly necessary" for a service you have explicitly requested.
The strictly necessary cookies described in Section 4 fall within that exemption: they exist only to let you sign in, or to keep a verified private conversation secure and accessible to you, which is the service you have asked for. For that reason, we do not currently display a cookie-consent banner — there is nothing on the Service today that requires opt-in consent.
If we introduce any non-essential cookie in the future (for example, an analytics or marketing cookie), we will:
- Update this Cookie Policy to describe it — its purpose, provider, and duration — before it is set;
- Implement a consent banner or preference centre that lets you accept or decline that category of cookie before it is set, in compliance with UK PECR / UK GDPR and the EU ePrivacy Directive / GDPR; and
- Only set that cookie after you have given consent, where consent is legally required.
7. Managing cookies through your browser
Because the only cookies we currently set are strictly necessary ones needed to keep you signed in, most browser settings to block or delete cookies will also sign you out of coffee-on.me or interrupt a verified share-link conversation. You're free to do this at any time through your browser settings, but be aware that:
- Blocking or deleting our authentication cookies will sign you out and require you to sign in again.
- Blocking or deleting our verification cookie on a share-link conversation may require you to re-verify your identity (for example, by requesting a new one-time code) before you can continue that conversation.
Most browsers let you view, delete, and block cookies through their settings menu (usually under "Privacy" or "Security"). Because this varies by browser, please consult your browser's own help documentation for exact steps.
8. Changes to this policy
We may update this Cookie Policy from time to time — for example, if the cookies we use change, or if the law requiring us to describe them changes. Any update will be reflected by a new "Last updated" date at the top of this page. Where a change is material (in particular, if we begin using non-essential cookies for the first time), we will provide a more prominent notice and, where legally required, seek your consent before the change takes effect.
9. Contact us
If you have questions about this Cookie Policy, please contact us at:
[Company contact email to be added] [Company registered address to be added]
This Cookie Policy should be read together with coffee-on.me's Privacy Policy and Terms of Service (where published), which describe our wider collection and use of personal data, including data processed once you are signed in to the Service.