Cookies Policy
Effective 6 September 2026 · Version 1.5
1. About this policy
This explains the cookies and similar technologies used on path2negotiate.com and in the Path2Negotiate app, and how to control them. It sits alongside our Privacy Policy, which covers personal data more broadly.
2. What cookies are
A cookie is a small file a site stores in your browser so it can recognise the browser later. Similar technologies — local storage and session storage — do much the same thing with data the site keeps on your device. This policy covers both.
3. How we ask
On your first visit a banner at the bottom of the page asks whether you want optional cookies. Two things about it are worth knowing:
- Nothing optional is set before you answer. Every optional signal is set to denied before the tag container is allowed to load, so closing the banner, pressing Escape or ignoring it all leave you with strictly necessary cookies only.
- Global Privacy Control is honoured automatically. If your browser sends the GPC signal, every optional category is switched off and you are not asked at all. You can still open the banner from the footer and switch analytics on for this site if you want to — the banner tells you your browser has opted you out, and a choice you make there is the one we follow. We treat GPC as a valid opt-out of "sale" and "sharing" under US state privacy laws.
4. The categories
4.1 Strictly necessary — always on
The cookie that keeps you signed in, and the local-storage entries that remember your cookie choice and your light/dark preference. Without the first you could not have an account at all, so it is not something we can offer to switch off. These are exempt from consent under the ePrivacy rules.
4.2 Analytics — consent required
One tool: Amplitude, which tells us which steps of the public flow people complete and where they give up. It sends our data to its EU endpoint, and it is off unless you turn it on.
Amplitude is loaded through Google Tag Manager, which is a tag loader and nothing more — it decides when Amplitude may run and collects nothing itself. We do not use Google Analytics, and no Google analytics cookie is set on this site.
4.3 Advertising — none
There is no advertising, no ad targeting and no advertising category to consent to.
5. What is actually set
| Name | Provider | Category | Purpose | Lasts |
|---|---|---|---|---|
sb-…-auth-token | Supabase, on our behalf | Strictly necessary | Your signed-in session. Set when you follow a sign-in link and refreshed on each request so you are not signed out mid-drill. | Until you sign out or it expires |
p2n-consent-v1 | Path2Negotiate (local storage) | Strictly necessary | Remembers your cookie choice so you are not asked again. | Until you clear site data |
theme | Path2Negotiate (local storage) | Strictly necessary | Remembers light, dark or system. | Until you clear site data |
AMP_<key> | Amplitude | Analytics | Identifies this browser and its current session, so a return visit is not counted as a new person. | Up to 1 year |
AMP_MKTG_<key> | Amplitude | Analytics | Remembers the referrer and campaign parameters you arrived with. | Up to 1 year |
Paying is the one step that leaves our site: you enter card details on Stripe's own checkout page, on Stripe's domain. The cookies Stripe sets there are Stripe's and are governed by Stripe's privacy policy. This table lists what is set on ours.
5.1 The record we keep of your choice
When you accept, reject or save preferences, we write one line to our own database recording what you chose, whether it switched something off that had been on, whether you answered the banner or reopened it from the footer, whether your browser was sending Global Privacy Control, which version of this policy you were shown, which round of the consent question you were answering, and the time. Data-protection law requires us to be able to show that consent was given and that a withdrawal was acted on, and this is how we do it.
It is not tied to your account. The only thing in that line about who you are is your IP address put through a one-way keyed hash — a fixed-length string that cannot be turned back into an address without a secret held on our servers and never stored alongside it. There is no account id, no cookie id, no browser fingerprint and no user agent, so the record cannot be joined to your account or to anything else we hold. Closing the banner without answering writes nothing, because you have not chosen anything yet.
6. Changing your mind
Use the Cookie settings link in the footer of any page — or right here:
You can also block or delete cookies in your browser settings, and turn on Global Privacy Control if your browser supports it. Blocking the session cookie will stop you being able to sign in.
7. Changes to this policy
We may update this policy from time to time. If we make material changes we will post the updated policy here with a new effective date and, where required by law or where the change materially affects your rights, give additional notice by email or in the app. Changes take effect when posted, unless stated otherwise or unless a later date is required by law. If the category set changes we will ask for your consent again rather than holding you to an answer you gave about something else.