Cookies and browser storage

This site stores two cookies and one item of browser storage. That is all of it. None of the three is used to track you, to build a profile, to advertise to you, or to tell anybody else anything about you.

We do not ask you to accept cookies, and there is no banner, because we are not relying on your consent for any of this. A banner asking for permission we are not using would be theatre.

Every name below is read directly from the part of our code that sets it, rather than typed onto this page, so a page listing something we do not set is not possible without breaking the site. The audit behind it was carried out on 27 September 2026.

tradello_session

Keeps you signed in. It is a signed token that tells our server which account is making a request, and it is the only thing that does. Without it you would be signed out on every page.

• Type: Cookie
• How long: Until it expires or you sign out. Signing out clears it, and changing your password ends every session on the account at once.
• When you get it: Set only when you sign in, sign up or reset a password. A signed-out visitor browsing this site is not given one.
• Readable by scripts in your browser: No. It is marked HttpOnly, so no page script can read it, and it is never placed in a web address.
• Legal basis: Strictly necessary — Schedule A1, paragraph 4 — Paragraph 4 of Schedule A1 covers storage that is strictly necessary to provide a service you asked for, and names authentication expressly. Signing you in is the service. No consent is required for it and none is asked.
• Set by: The sign-in, sign-up and password-reset steps on this site, and nothing else.

tradello_procurement_view

Remembers how you last set up the opportunities view — the market and the display options you chose — so the screen comes back the way you left it.

• Type: Cookie
• How long: 30 days from the last time you changed it.
• When you get it: Signed-in customers only, and only after you change a view setting. It is scoped to the opportunities area rather than the whole site.
• Readable by scripts in your browser: No. It is marked HttpOnly, so no page script can read it, and it is never placed in a web address.
• Legal basis: Your preference — Schedule A1, paragraph 6 — Paragraph 6 of Schedule A1 covers storage whose sole purpose is adapting how the site appears or functions to your preferences. That is exactly what this does. Paragraph 6 also requires a simple means of objecting, free of charge — see the note below on what exists today.
• Set by: The opportunities screens, when you change a view setting there.

tradello.recent-searches.v1

Keeps the last five things you typed into the search box, on this device, so they can be offered back to you when you open it again.

• Type: Stored in your browser (local storage)
• How long: Until you clear your browser storage for this site. It has no expiry of its own.
• When you get it: Signed-in customers only. It is written by the search box in the application header, which a signed-out visitor never sees.
• Readable by scripts in your browser: Yes. It is ordinary browser storage on your own device and is never sent to us.
• Legal basis: Not settled — see below — It is a convenience, so paragraph 6 of Schedule A1 is the obvious limb — but paragraph 6 requires a simple means of objecting, free of charge, and this product does not have one for this item today. Rather than claim a limb that is not made out, this page records the position as unresolved and the gap is stated below.
• Set by: The search box in the header, which keeps the list in your own browser.

Any site can type a sentence about using only what it needs. These are the specific things the audit searched the whole codebase for and did not find, so you can see exactly what that claim is covering here rather than having to take it on trust:

• No analytics of any kind. No Google Analytics, no Google Tag Manager, no gtag, no Plausible, no PostHog, no Fathom and no Hotjar.
• No advertising or social pixel. No Meta pixel, no LinkedIn Insight tag, no conversion tracking of any kind.
• No third-party script on any page. There is no script loaded from another company’s server anywhere on this site.
• No third-party font request. The typeface is downloaded when the site is built and served from this site’s own address, so your browser never asks another company for it.
• No session storage and no IndexedDB.
• No cookie, storage item or script set by Stripe on this site. Paying takes you to Stripe’s own checkout page on Stripe’s own address, and anything Stripe sets is set there, after you have left this site, under Stripe’s notice.
• No cookie banner, because nothing here is being asked for that would need one — and a banner asking for consent we are not relying on would be theatre.

These are findings from an audit on a date, not promises about the future. If any of them changes, this page changes with it — and the list above is built from our own code, so it cannot quietly fail to.

Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 was replaced on 5 February 2026 by section 112 of the Data (Use and Access) Act 2025. It now says that, subject to Schedule A1, “a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user”.

That covers more than cookies. It covers anything stored on your device, which is why the local storage item above is on this page rather than left off it.

The exceptions we rely on are in Schedule A1:

• Paragraph 4 — storage strictly necessary to provide a service you asked for, which expressly includes authentication. This is what keeps you signed in.
• Paragraph 6 — storage whose sole purpose is adapting how the site appears or functions to your preferences, provided you are given clear information and “a simple means of objecting, free of charge”.

We rely on no other paragraph. In particular we do not rely on paragraph 5, the statistical limb, because we collect no statistics.

Paragraph 6 of Schedule A1 to the 2003 Regulations lets a site store a preference without consent, but only where the visitor is given clear information and a simple means of objecting, free of charge. We give the information here. We do not yet give a control on this site that switches the recent-searches list off or clears it, and clearing your whole browser storage is not obviously the simple means the paragraph has in mind. Until that control exists we record the position for that one item as unresolved rather than claiming an exception we have not made out. It affects a list of five search terms held on your own device and shared with nobody, which is why it is stated here rather than treated as an emergency — but a small gap described accurately is worth more than a large claim.

• Sign out. That clears the sign-in cookie immediately. Changing your password ends every session on the account at once.
• Change the view setting back. The opportunities view cookie records whatever you last chose, so changing it changes what is stored.
• Clear this site’s data in your browser. Every browser offers this, and it removes all three items, including the recent-searches list. You will be signed out.
• Block cookies for this site. You can, and the site will stop being able to sign you in, because the sign-in cookie is how it knows which account is asking. Nothing else will break.

There is no switch on this site to turn off the recent-searches list, and we are not going to describe clearing your browser storage as though it were one. That gap is stated above rather than dressed up.

Paying takes you to Stripe’s own checkout page, at Stripe’s own web address. Stripe.js does not run on this site and Stripe sets nothing on this domain. Anything Stripe stores, it stores once you have left here, on its own page, under its own notice. Card details are never sent to us and never stored by us — see the privacy notice.