Cookies & Analytics
Every cookie Govscape sets, what each one does, and how long it lasts. There is no advertising cookie, no cross-site tracker, and no third-party analytics product.
Last reviewed 9 September 2026
Still to be added to this page: the operating company’s registered name, company number and registered office, and our registration number with the Information Commissioner’s Office. In the meantime, write to sales@govscape.app about anything in this document, including a request about your personal data.
1Why there is no cookie banner
UK and EU law requires consent before storing anything on your device that is not strictly necessary for a service you asked for. Every cookie listed below is strictly necessary: it signs you in, keeps you on the right client organisation, or stops a security control being bypassed. Remove any of them and the product breaks rather than becomes less personalised.
So there is nothing to ask you to consent to, and a banner asking anyway would be theatre. If we ever add a cookie that is not strictly necessary, this page changes and you will be asked first.
2The cookies we set
| Cookie | What it does | How long |
|---|---|---|
sb-<project>-auth-token | Keeps you signed in. Set by Supabase, our authentication provider, and read on every request to identify you. | Until you sign out, or the session expires |
active_client | Remembers which client organisation you are currently working on, so the product shows the right data after a page load. | 24 hours |
gov_connector_nonce | A one-time random value that proves the Microsoft 365 authorisation response came back from the request you started. Without it, someone else could attach a Microsoft tenant to your organisation. | 10 minutes |
gov_consent_link | Carries the identifier of the consent link you followed, so the connection is attached to the right organisation. Held in a cookie specifically to keep it out of the address bar and browser history. | 15 minutes |
partner_session | Signs you in to the partner portal after you verify your email address. | 30 days |
gff_allowed / gff_skipped_session | Remembers that you have completed or skipped the guided first-run flow, so it is not shown again and we do not re-query the database on every navigation. | 10 minutes (gff_allowed); the browser session (gff_skipped_session) |
gs_client_ok | Remembers for a few minutes that your account has at least one client, so every page load does not have to check again before letting you in. | 10 minutes |
gs_role | Remembers your role on the client you are working on, so actions you are not allowed to take are refused without a database lookup on every request. | 5 minutes |
gs_mfa_optional | Remembers that two-step verification is optional for your account, so you are not asked again on every page. | 10 minutes |
demo-session | Marks a demonstration session. Only set on demo accounts, never on a customer account, and it cannot coexist with a real sign-in. | 24 hours |
All of them are first-party. All but one are HttpOnly, which means no script on the page can read them; the exception is gff_allowed, which holds nothing but the value 1. All are SameSite=Lax and, in production, Secure.
3Analytics
We do not use Google Analytics, or any other third-party analytics or advertising product. We do not run a tag manager, an advertising pixel, a heatmap tool or a chat widget. Nothing on this site profiles you across other websites.
4What we do run: error monitoring and session replay
We use Sentry to find faults. It is not an analytics product — it exists to tell us that something broke and what the browser was doing when it did — but it is the one thing on the page that reports back, so it is described here rather than left to be discovered.
Sentry receives:
- Errors and stack traces, with the page you were on.
- Browser console output.
- Performance timings for a sample of page loads.
- Session replays — a reconstruction of what the page looked like and what was clicked — only for a session in which an error occurs. Ordinary sessions are not recorded.
Replay masks all text before it leaves your browser, so the contents of your documents and form fields are not captured; what is reconstructed is the layout and the interactions. Images and other media are blocked too.
Sentry data is sent through our own domain rather than directly to Sentry’s, which is done so that corporate network filters do not silently suppress error reports. The practical consequence is that a browser ad-blocker will not stop it, and we would rather say that than leave you to find out.
To be excluded from session replay, email sales@govscape.app and we will exclude your account.
5Local storage
The product stores a few preferences in your browser’s local storage rather than in a cookie: your light or dark theme, which sidebar sections you have collapsed, the advisor tab you last had open, and an identifier for your current advisor conversation. These never leave your browser and are not sent to us. Clearing site data removes them.
6Controlling cookies
Your browser can block or delete cookies. Because ours are all strictly necessary, blocking them means you will not be able to sign in. Clearing them signs you out.
7More detail
What we collect and why is set out in the privacy policy, and the companies involved are named on the sub-processor list.