Cookies & Analytics
Every cookie GovScape sets, what each one does, and how long it lasts. There is no advertising cookie, no cross-site tracker, and no third-party analytics product.
Last reviewed 9 September 2026
Draft — not yet published
This document is complete except for the facts below, which cannot be determined from the application and must be supplied before it is relied on:
- Registered company name of the operating entity
- Companies House company number
- Registered office address
- ICO registration reference (data protection fee)
- A monitored inbox for privacy and data subject requests
- Supabase project region — where the database, logins and uploaded files actually live
- Sentry data residency — currently the US, with AUD-44 open to move it to the EU
- Confirmation that a UK IDTA or SCC addendum is signed with every processor outside the UK
Filling in lib/legal/entity.ts removes this notice from every legal page.
1Why there is no cookie banner
UK and EU law requires consent before storing anything on your device that is not strictly necessary for a service you asked for. Every cookie listed below is strictly necessary: it signs you in, keeps you on the right client organisation, or stops a security control being bypassed. Remove any of them and the product breaks rather than becomes less personalised.
So there is nothing to ask you to consent to, and a banner asking anyway would be theatre. If we ever add a cookie that is not strictly necessary, this page changes and you will be asked first.
2The cookies we set
| Cookie | What it does | How long |
|---|---|---|
sb-<project>-auth-token | Keeps you signed in. Set by Supabase, our authentication provider, and read on every request to identify you. | Until you sign out, or the session expires |
active_client | Remembers which client organisation you are currently working on, so the product shows the right data after a page load. | 24 hours |
gov_connector_nonce | A one-time random value that proves the Microsoft 365 authorisation response came back from the request you started. Without it, someone else could attach a Microsoft tenant to your organisation. | 10 minutes |
gov_consent_link | Carries the identifier of the consent link you followed, so the connection is attached to the right organisation. Held in a cookie specifically to keep it out of the address bar and browser history. | 15 minutes |
partner_session | Signs you in to the partner portal after you verify your email address. | 30 days |
gff_allowed / gff_skipped_session | Remembers that you have completed or skipped the guided first-run flow, so it is not shown again and we do not re-query the database on every navigation. | 10 minutes (gff_allowed); the browser session (gff_skipped_session) |
demo-session | Marks a demonstration session. Only set on demo accounts, never on a customer account, and it cannot coexist with a real sign-in. | 24 hours |
All of them are first-party. All but one are HttpOnly, which means no script on the page can read them; the exception is gff_allowed, which holds nothing but the value 1. All are SameSite=Lax and, in production, Secure.
3Analytics
We do not use Google Analytics, or any other third-party analytics or advertising product. We do not run a tag manager, an advertising pixel, a heatmap tool or a chat widget. Nothing on this site profiles you across other websites.
4What we do run: error monitoring and session replay
We use Sentry to find faults. It is not an analytics product — it exists to tell us that something broke and what the browser was doing when it did — but it is the one thing on the page that reports back, so it is described here rather than left to be discovered.
Sentry receives:
- Errors and stack traces, with the page you were on.
- Browser console output.
- Performance timings for a sample of page loads.
- Session replays — a reconstruction of what the page looked like and what was clicked — for a small sample of sessions, and for every session in which an error occurs.
Replay masks all text before it leaves your browser, so the contents of your documents and form fields are not captured; what is reconstructed is the layout and the interactions. Images and other media are not masked.
Sentry data is sent through our own domain rather than directly to Sentry’s, which is done so that corporate network filters do not silently suppress error reports. The practical consequence is that a browser ad-blocker will not stop it, and we would rather say that than leave you to find out.
To be excluded from session replay, email sales@govscape.app and we will exclude your account.
5Local storage
The product stores a few preferences in your browser’s local storage rather than in a cookie: your light or dark theme, which sidebar sections you have collapsed, the advisor tab you last had open, and an identifier for your current advisor conversation. These never leave your browser and are not sent to us. Clearing site data removes them.
6Controlling cookies
Your browser can block or delete cookies. Because ours are all strictly necessary, blocking them means you will not be able to sign in. Clearing them signs you out.
7More detail
What we collect and why is set out in the privacy policy, and the companies involved are named on the sub-processor list.