Cookie and Storage Policy
Last updated: 21 October 2026
1. What This Policy Covers
This policy explains the cookies and similar technologies (such as browser localStorage and sessionStorage) that TradePilot uses on its website and web app, why we use them, and how you can control them.
The law that governs this is regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025 from 5 February 2026. Under it, we may store or read information on your device only with your consent, unless one of the exceptions applies. The exceptions we rely on are:
- Strictly necessary — the storage is needed to provide a service you have asked for, such as keeping you signed in or protecting a form from forgery.
- Appearance or preference — the storage remembers how you want the site to look or behave (for example, light or dark theme). We may use this exception only if we give you clear and full information about it and a simple, free way to object. Section 6 explains how to object.
2. Our Summary
- We do not use analytics or advertising cookies today. No Google Analytics, Meta pixel, Google Tag Manager or advertising tracker runs on tradepilot.work or app.tradepilot.work. The one analytics script is Cloudflare Web Analytics on the public website: it sets no cookies and counts page views (section 5).
- A visit to the public website (tradepilot.work) sets no cookies from our code.
- The web app (app.tradepilot.work) sets two strictly necessary cookies when it loads, because it checks with our server whether you are signed in (section 3).
- Both sites use a small amount of browser storage to remember preferences and to stop you losing work (sections 3 and 4).
- Our network provider, Cloudflare, may set a security cookie in limited circumstances (section 5).
3. The Web App (app.tradepilot.work)
3.1 Cookies
| Name | Type | Purpose | Category | Duration |
|---|---|---|---|---|
tradesmanexperts-session | First-party cookie | Keeps you signed in and links your requests to your session after you sign in | Strictly necessary | 2 hours, renewed each time you use the app |
XSRF-TOKEN | First-party cookie | Protects forms and actions from cross-site request forgery | Strictly necessary | 2 hours, renewed each time you use the app (the same as the session cookie) |
These cookies can be set as soon as the app loads, because the app asks our server whether you are signed in, as well as when you sign in or use the app.
3.2 Browser Storage
| Key or item | Storage | Purpose | Category | How long it stays |
|---|---|---|---|---|
| Job-intake drafts (one per business and user) | localStorage | Saves a new job you are still typing so you do not lose it if the page reloads. It can contain details of your customers that you have typed in. | Strictly necessary (keeps a service you asked for working) | Until you submit or discard the draft, sign out, or clear site data (signing out clears them) |
te_access_token and related legacy keys | localStorage | Old sign-in token keys from an earlier version of the app. The app now uses the session cookie and clears these keys when it runs. | Strictly necessary (being removed) | Deleted by the app |
theme | localStorage | Remembers whether you chose the light or dark appearance in the app | Appearance preference (see section 6 for how to object) | Until you clear this site's stored data (changing the theme stores the new choice) |
| Invitation details | sessionStorage | Remembers the team invitation you followed while you finish signing up | Strictly necessary | Until you close the tab |
| Idempotency keys | sessionStorage | Stops the same action (for example, a payment or a submitted form) being sent twice if you click again or the connection drops | Strictly necessary | Until you close the tab |
Because job-intake drafts can hold customer information, please do not leave drafts in progress on a shared or public computer.
4. The Public Website (tradepilot.work)
4.1 Cookies
Our own code on tradepilot.work sets no cookies.
4.2 Browser Storage
| Key or item | Storage | Purpose | Category | How long it stays |
|---|---|---|---|---|
theme | localStorage | Remembers the theme you chose with the theme button (light, dark, or follow your device setting) | Appearance or preference | Until you clear this site's data in your browser. Choosing another theme replaces the stored value; it does not remove it |
te-early-adopter-dismissed | localStorage | Remembers that you closed the early-adopter banner so it does not keep reappearing | Appearance or preference | Until you clear this site's data in your browser |
| Onboarding selected plan | localStorage | Saved whenever the onboarding page is opened: the plan named in the link you followed, otherwise the last plan saved, otherwise Starter. It is pre-selected when you start signing up. It is saved even if you do not choose a plan | Appearance or preference (see section 6 for how to object) | Until you clear this site's data in your browser. It is not removed when sign-up completes |
4.3 Fonts
Our website uses two fonts from the Google Fonts library (Inter and Oswald). They are bundled with our site and served from our own servers, so your browser does not contact Google to fetch them.
4.4 Embedded Video (YouTube)
Our “How it works” page includes a YouTube video using YouTube's privacy-enhanced mode (youtube-nocookie.com). In this mode, YouTube says it does not store cookies to personalise your experience on the page until you play the video. However, loading the embedded player still connects your browser to Google's servers, and once you play the video, YouTube (Google) may store or read information on your device under its own privacy policy.
If you do not want this, do not play the video. You can block the player with a content-blocking browser extension.
5. Cloudflare
All traffic to our sites passes through Cloudflare, which provides our network, DNS and protection against attacks and abusive bots.
- Cloudflare's security features may set a cookie (for example
__cf_bmorcf_clearance) when a request is checked or challenged as possible automated traffic. This cookie helps tell people apart from automated traffic and protects the service. We treat it as strictly necessary for security. - Cloudflare Web Analytics is switched on for the public website (tradepilot.work) and for the business websites we host. Cloudflare adds a small script to those pages that counts page views. It sets no cookies and stores nothing on your device. It sends Cloudflare the page address, the referring page, your browser type and your IP address, which Cloudflare uses to produce anonymous visit counts for us. It does not run in the web app (app.tradepilot.work). To object, block the script (it loads from
static.cloudflareinsights.com) with a content-blocking browser extension; the website works the same without it. You can also tell us at [email protected].
6. How to Control or Object
- Preferences (theme and banner dismissal on the website, theme in the app) and the selected plan — you can object at any time, free of charge, by clearing the stored data for the site concerned in your browser: tradepilot.work for the website items, and app.tradepilot.work for the app's theme (each site stores its own items). Choosing another theme stores the new choice rather than removing the item, and the website has no way to reopen the banner. To clear it: in Chrome or Edge, click the icon to the left of the web address, open the site settings and choose to delete or clear the site's data; in Firefox, click the padlock and choose “Clear cookies and site data”; in Safari, go to Settings (or Preferences), then Privacy, then Manage Website Data, and remove tradepilot.work or app.tradepilot.work. Menu names can differ between browser versions. Clearing app.tradepilot.work's data also signs you out of the app and deletes any job drafts you have not submitted, so submit or note them first. Clearing the data removes these items until you change the theme, close the banner or open the onboarding page again.
- Strictly necessary items — you can block or delete them in your browser, but the app will not work properly. For example, you will not be able to stay signed in.
- Browser settings — most browsers let you view, block and delete cookies and site data. See your browser's help pages.
7. Mobile App
This policy covers the website and web app only. The TradePilot mobile app is covered by our Privacy Policy. The app stores on your device only what it needs to work: your sign-in, the job data it keeps for working offline, and your settings.
8. If We Add Analytics in Future
Apart from the cookieless Cloudflare Web Analytics on the public website (section 5), we do not use analytics today. If we add analytics that relies on the PECR statistical purposes exception (rather than consent), the law requires that we give you clear and full information about the purpose and a simple, free way to object, and that you have not objected. We would then:
- add a row for each analytics cookie or storage item to the tables above before it goes live;
- add an analytics switch, on by default only where the exception allows it, that you can turn off at any time and that stops collection immediately on that browser; and
- publish clear information about the analytics and how to switch it off.
Any analytics that does not fit the statistical exception (for example, advertising or cross-site tracking such as a Meta pixel) would need your consent before it runs, through an opt-in banner.
9. Changes and Contact
We will update this policy when the cookies or storage we use change, and show the date of the last update at the top. Questions: [email protected].