Prerode Cookie Policy

A cookie is a small text file that a website places on your device when you visit it. Cookies are widely used to make websites work, to make them work more efficiently, and to provide information to the operator of the site.

“Similar technologies” means other methods used to store or read information on your device, including HTML5 local storage, session storage, web beacons, tracking pixels and software development kits. Under the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended (PECR), the same rules apply to cookies and to these similar technologies.

Cookies are described as “first-party” when they are set by the website you are visiting, and “third-party” when they are set by another organisation. They are described as “session” cookies when they are deleted at the end of your browser session, and “persistent” cookies when they remain on your device until they expire or are deleted.

The first time you visit Prerode, we show a cookie banner at the bottom of the page. Until you make a choice, we only set cookies and use storage that is strictly necessary to provide the service you have asked for. No optional cookies, and no analytics scripts, are loaded before you agree.

The banner offers two choices with equal weight: Reject optional and Accept optional. There are no pre-ticked boxes and no implied consent from continued browsing.

We record your choice in a first-party cookie called prerode_consent so we do not have to ask you again on every page. The cookie lasts for 180 days, after which we will ask again. You can change your choice at any time by clicking the button below or by clearing this cookie in your browser.

You can also withdraw or change your choice at any time using this button:

Withdrawing consent is as easy as giving it. When you withdraw consent, we immediately expire the analytics cookies that were set, both on the current domain and on the parent domain, so they no longer identify you.

These cookies are required for Prerode to work and to keep your account and session secure. Under regulation 6(4) of PECR, we do not need your consent to set them because they are strictly necessary to deliver the service you have requested. If you block them, parts of the site will not work correctly.

Authentication

• Cookie names: prerode-auth-token, and its chunked variants prerode-auth-token.0, prerode-auth-token.1 when the token is large
• Provider: Prerode (first-party), issued by our authentication provider Supabase and set through our servers
• Purpose: Keeps you signed in, refreshes your session, and lets our servers verify who is making a request.
• Duration: Session and refresh tokens. The refresh token typically lasts up to a few weeks and rotates each time your session refreshes.
• Type: First-party, HttpOnly, Secure, SameSite=Lax.

Consent record

• Cookie name: prerode_consent
• Provider: Prerode (first-party)
• Purpose: Remembers whether you accepted or rejected optional cookies so we do not repeatedly ask.
• Duration: 180 days.
• Type: First-party, Secure (on HTTPS), SameSite=Lax.

Session integrity and security

Our hosting provider (Vercel) and our infrastructure provider (Supabase) may set short-lived cookies used for load balancing, request routing and security (for example to protect against cross-site request forgery). These are strictly necessary for the service to operate safely.

If you agree, we load Google Analytics 4 to help us understand which pages are used, which features are helpful, and where the site is slow or broken. Without this we are working blind on a small budget. If you reject, none of these cookies are set and no data is sent to Google.

We do not use Google Analytics for advertising, remarketing or profiling. We do not link analytics data to your Prerode account. We enable IP anonymisation and we do not enable Google Signals or ad personalisation. Analytics scripts do not load on localhost or development environments, so we are not able to measure our own testing traffic.

Cookies set by Google Analytics 4

• _ga: distinguishes unique users so we can count visits. Third-party (Google). Persistent, 2 years.
• _ga_<container-id>: used by GA4 to maintain session state. Third-party (Google). Persistent, 2 years.

Google Analytics 4 is provided by Google Ireland Limited. Data may be processed by Google in the United States and other countries. Google's own information about analytics cookies is available at policies.google.com/technologies/partner-sites and their privacy policy is at policies.google.com/privacy.

Lawful basis: your consent under regulation 6 of PECR and Article 6(1)(a) of the UK GDPR. You can withdraw consent at any time using the button in Section 2.

We use a small amount of client-side storage. These are not cookies but PECR treats them in the same way, so we list them here for transparency.

Local storage

• smb:recent-searches: stores the last few searches you have made from the header search box so you can quickly re-run them. This is stored only in your browser. It is not sent to our servers (signed-in users have a separate server-side history instead) and it is not shared with any third party. You can clear it from your browser's site storage settings at any time.

Session storage

• prerode:signup_draft: temporarily stores what you have typed into the signup form so that verifying your email in a new tab does not lose your progress. It is cleared when your session ends or when signup completes.

Both of these are strictly necessary for features you have asked for (searching and signing up) and therefore do not require consent under PECR.

Error monitoring

We use Sentry to detect and diagnose errors on the site. Sentry is loaded through our own domain (requests are tunnelled via /monitoring) so no third-party cookies are set. Sentry does not sample normal browsing sessions. It captures a short session replay only when an error occurs, and in those replays all text is masked and media is blocked, so the content of what you saw and typed is not recorded. This is used solely to make the site work reliably and is covered by our legitimate interests under Article 6(1)(f) of the UK GDPR.

For the avoidance of doubt, Prerode does not currently use any of the following:

• advertising, remarketing or behavioural profiling cookies;
• third-party marketing pixels (for example from Meta, TikTok, X or LinkedIn);
• fingerprinting, canvas fingerprinting or other techniques designed to identify your device without cookies;
• social-media sharing widgets that set cookies;
• data brokers or third-party audience-building services;
• sale of personal information.

If any of this changes, we will update this page before enabling the new technology and, where required, ask for your consent through the cookie banner.

The third-party organisations below may set cookies through Prerode or receive information linked to cookies:

• Google Ireland Limited (Google Analytics 4): only after you accept optional cookies. See policies.google.com/privacy.
• Supabase Inc. (authentication, database): strictly necessary cookies used to keep you signed in. See supabase.com/privacy.
• Vercel Inc. (hosting): may set short-lived cookies for routing and security. See vercel.com/legal/privacy-policy.
• Functional Software, Inc. (Sentry): error monitoring and masked, error-only session replay. Tunnelled through our own domain, so no third-party cookies are set. See sentry.io/privacy.

We do not control the cookies set by these third parties on their own services, only what we ask them to do on ours. Their policies apply to any processing they carry out for their own purposes.

Some of the providers above are based outside the United Kingdom, in the European Economic Area or the United States. Where personal information is transferred internationally, we rely on appropriate safeguards required by UK data-protection law, such as UK adequacy regulations (including the UK-US Data Bridge, where the recipient is certified), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for a summary of the safeguards that apply to a specific provider by emailing support@prerode.com.

You can manage or delete cookies through your browser at any time. Doing so for the strictly necessary cookies listed in Section 3 will sign you out of Prerode and may stop parts of the site from working correctly.

Instructions for the most common browsers are below:

• Google Chrome
• Mozilla Firefox
• Safari (macOS)
• Safari (iOS)
• Microsoft Edge

You can also opt out of Google Analytics on any site by installing the Google Analytics opt-out browser add-on.

There is currently no consistent industry standard for how websites should respond to a Do Not Track signal. We rely on our own cookie banner and the controls in Section 2 to record your choice, rather than on Do Not Track. If a recognised UK standard emerges (such as Global Privacy Control being formally endorsed by the ICO), we will update this policy to reflect it.

We may update this Cookie Policy from time to time, including where we change the tools we use or where legal requirements change. The date at the top of this page shows when it was last updated. Where a change materially affects the cookies we use or the choices available to you, we will bring the change to your attention through the cookie banner or another appropriate notice.

If you have questions about this Cookie Policy or want to exercise a data-protection right, contact:

support@prerode.com

SP8CESTUDIO LTD (trading as Prerode)
21 Uplands Avenue, Willenhall, WV13 3PR
Company number: 12134895
ICO registration number: ZC047049

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection and PECR. You can find information about making a complaint on the ICO website at ico.org.uk. You do not have to contact us before making a complaint.

• Privacy Policy
• Terms of Service