What cookies are
Cookies are small text files stored on your device. Similar technologies include local storage, session storage, pixels and software-development kits. The rules below apply to all of them, not only files called cookies.
Legal
Cookies,the short version.
What the live site stores, which parts are optional, and how to change your choice without losing access to a course or checkout.
Last updated · 29 August 2026
Strictly necessary
These support a service you request and do not need optional consent. Supabase sb-* cookies keep a member signed in for up to one year, or for the browser session if ‘Keep me signed in’ is switched off. au_session_only remembers that sign-in choice. au_optional_consent_v1 remembers your Meta advertising choice and au_analytics_consent_v1 remembers your site-analytics choice, both for 180 days. Stripe and Cloudflare may use necessary storage for payment, fraud prevention and human verification. The service worker may cache site files for reliable loading. Blocking these in your browser can stop sign-in, security checks or checkout from working.
Anonymous visit counting
The site keeps aggregate counts of page visits and Meta advertising-measurement choices: which page, on which day, from which rough source, and whether Meta measurement was allowed or declined. These counters set no cookie, store nothing on your device and record no IP address, email, member, browser identifier or session identifier. They cannot be turned into a profile of you.
Optional first-party measurement
Only after you allow site analytics, au_attr stores first-touch campaign parameters, landing path and referrer for up to 90 days. The site also uses au:tracker-session-v1 and au:tracker-last-seen-v1 in session storage to group anonymous page views into a browser-tab session. They contain no name or email and are not linked to a member account. Plausible and Vercel measurement also load only after this choice; they are configured without an advertising profile cookie.
Optional Meta advertising measurement
Only after you allow advertising measurement, Meta Pixel may set _fbp and _fbc, normally for up to 90 days, to measure visits and link a conversion to an advert. Meta Conversions API may receive a deduplicated Lead or Purchase event as described in the privacy policy, including when you allow measurement just after opening a new course. Provider-controlled storage and duration can change; Meta publishes its own current notice.
Your choice
Optional services are off by default and no consent panel interrupts a first visit. Use ‘Cookie settings’ in the footer if you want to allow optional measurement or choose site analytics and Meta advertising separately. A course form may also offer an unticked, optional Meta measurement checkbox at the point of signup. Withdrawing permission stops the relevant tags on the next document load and removes known optional first-party attribution, session or Meta storage where the browser permits it. You can also clear provider storage in browser settings.
Email consent is separate
The tracking choice does not subscribe you to email, and rejecting tracking does not stop a course signup, service email or purchase. Email preferences are controlled at the signup form and through the unsubscribe route in marketing messages.
Questions
For a question about a cookie, a provider, or the current retention period, email hello@aunlock.co.uk. The Information Commissioner's Office also publishes independent guidance at ico.org.uk.