Cookie policy
Last updated 28 September 2026
What the Kept website and app store on your device, why, how long for, and how to change your choice.
1. In short
- Analytics only with your permission. The Google Analytics script does not load until you choose “Accept”. Choose “Essential only” and nothing is sent to Google.
- One cookie keeps you signed in.
kept_sessionis strictly necessary, and a second security cookie,kept_device, lets us warn you about sign-ins from a new device. - Referral links set two cookies, so the person who recommended Kept is credited. You only get them if you arrive through a referral link.
- Change your mind at any time with Cookie settings in the footer of any page, or in your browser settings.
3. The website
This covers usekept.co.uk and our programme sites, trade.usekept.co.uk and refer.usekept.co.uk. The website carries no advertising, retargeting or social media tags and no session recording. When analytics is in use, a banner asks on your first visit whether to allow it. This is everything the website can store in your browser:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| kept_ | CookieStrictly necessary | Keeps you signed in. Set by the Kept API when you sign in, on the website or in the app, and shared by usekept.co.uk and its subdomains. It is httpOnly, so scripts on the page cannot read it, and SameSite=Lax. Never used for analytics or advertising. | Seven days, or until you sign out |
| kept_ | CookieStrictly necessary, for security | Recognises a browser you have signed in from before, so we can email you when your account is used from a new device. httpOnly, and holds a random token rather than anything about you. | About 13 months |
| kept_ | Session storageStrictly necessary | Holds a short-lived token between signing in with Google and entering your two-factor code. Only used if you have two-factor authentication turned on. | Removed when used; the token expires after five minutes |
| kept_ | CookieReferral links only | Set only if you arrive through somebody's referral link (/r/CODE). A random identifier with no personal data in it, so the same click is not counted twice. | 400 days |
| kept_ | CookieReferral links only | Holds the referral code from the link you followed, the random visitor identifier and the asset you used, so the person who recommended Kept is credited if you sign up. The signup form reads it, so it is not httpOnly. | The referral's credit window, normally 90 days |
| cookie_ | Local storageRemembers your choice | Records whether you chose “Accept” or “Essential only”, so the banner does not ask again on every page. Written only when you choose. | Until you clear it |
| visit_ | Session storageOnly sent if you enquire | Notes the page you arrived on and when, the site that sent you, any campaign tags and ad click IDs in that first link, the previous page and how many pages you have viewed. It stays in this tab and only reaches us if you send the contact form. | Until you close the tab |
| mapbox. | Local storageNeeded to show the map | Set by Mapbox when a council map on the local guide, duty or feature pages loads. Holds a random identifier and the time of the last map load, which Mapbox uses to count map loads for its service. No cookie is set. | Until you clear it |
| _ga | CookieAnalytics, only if you allow it | Set by Google Analytics to tell one visitor from another, so that visits are counted rather than page loads. | Two years |
| _ga_ | CookieAnalytics, only if you allow it | Set by Google Analytics to keep the state of your visit, such as when it started and how many pages you have viewed. | Two years |
cookie_consent, visit_journey and kept_google_mfa_challenge are kept in your browser's storage rather than set as cookies, so they are not sent to us as you browse. The notes in visit_journey are only sent if you submit the contact form, when they are included with your message, as described in the privacy policy.
Our web server also keeps a standard log of requests. That is not a cookie and is covered by the privacy policy too.
4. Google Analytics
We use Google Analytics 4 to see which pages are useful and how people find the site. It is provided by Google Ireland Limited, with Google LLC, and it runs only if you allow it.
- The Google Analytics script only loads after you allow analytics. If you choose “Essential only”, or make no choice, nothing is sent to Google.
_gatells one visitor from another and_ga_<container-id>keeps the state of your visit. Both last two years unless you delete them.- GA4 does not log or store IP addresses.
- Advertising features are off. The site tells Google not to use advertising storage, not to use your data for advertising and not to personalise ads.
- Google may process the data in the United States, under the UK Extension to the EU-US Data Privacy Framework.
- We keep analytics data for up to 14 months.
- Withdrawing consent stops Google Analytics and removes the
_gacookies it has set.
Google explains how it uses information from websites that use its services at policies.google.com/technologies/partner-sites.
5. The Kept app
When you sign in to the Kept app (app.usekept.co.uk, and the installed app), it stores the following. None of it is used for analytics or advertising, and the app does not run Google Analytics.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| kept_ | CookieStrictly necessary | Keeps you signed in. Set by the Kept API when you sign in, on the website or in the app, and shared by usekept.co.uk and its subdomains. It is httpOnly, so scripts on the page cannot read it, and SameSite=Lax. Never used for analytics or advertising. | Seven days, or until you sign out |
| kept_ | CookieStrictly necessary, for security | Recognises a browser you have signed in from before, so we can email you when your account is used from a new device. httpOnly, and holds a random token rather than anything about you. | About 13 months |
| kept: | Local storageRemembers your progress | Remembers how far you got through first-time setup, so you can pick up where you left off. | Removed when setup is finished |
| kept: | Local storageRemembers your choice | Remembers that you dismissed the trial offer on your dashboard, so it is not shown again. | Until you clear it |
| kept: | Local storageRemembers your choice | Remembers that you dismissed the licensing prompt on a property. | Until you clear it |
| keptBillingReturn | Session storageStrictly necessary | Remembers a payment in progress while you confirm it with your bank, so the app can show the result when you come back. | Removed once read, or when you close the tab |
| __stripe_ | CookieStrictly necessary, for fraud prevention | Set by Stripe, our payment processor, when the payment form opens, to help prevent card fraud. | __stripe_mid one year, __stripe_sid 30 minutes |
| App files | Cache storageStrictly necessary | A copy of the app's own program files, kept by its service worker so the app opens quickly and updates itself. It holds no personal data. | Replaced on each update |
| mapbox. | Local storageNeeded to show the map | Set by Mapbox when a property map loads. Holds a random identifier and the time of the last map load, which Mapbox uses to count map loads for its service. No cookie is set. | Until you clear it |
The session, security, payment and app-file items are strictly necessary to provide the service you signed in for, so PECR does not require consent for them. The items that remember a choice are only written when you dismiss something or work through setup.
6. Other services
- Sign in with Google. If you choose to sign up or sign in with Google, the sign-in and signup pages load Google's sign-in button. Google sets its own cookies on its own domains under the Google privacy policy. We do not control them and cannot see them.
- Stripe. Payments in the app are taken by Stripe. Its fraud-prevention cookies are listed in the app table above and described in Stripe's cookie policy.
- Mapbox. Maps on the website and in the app are drawn by Mapbox, which stores the item listed above in local storage. See the Mapbox privacy policy.
7. Changing your choice
You can change your analytics choice at any time using the Cookie settings link in the footer of every page, which appears whenever analytics is in use. Choosing “Essential only” there withdraws your consent: it stops Google Analytics and removes the _ga cookies it has set.
You can also view, block and delete cookies in your browser settings. Blocking them does not stop the website working, but it will stop you signing in to Kept, because the session cookie is how Kept knows it is you. Clearing this site's stored data means the banner asks you again on your next visit.
General guidance on managing cookies is available from the Information Commissioner's Office.
8. Changes to this policy
We will update this page, and the date at the top, before we change what the website or the app stores on your device.
Questions about cookies: hello@usekept.co.uk.