Cookie and Similar Technologies Policy
Effective date: 24 October 2026 Last updated: 24 October 2026
1. Scope
JITI LTD, trading as Guides.app, uses device storage and access technologies for the purposes described below. These can include cookies, local/session storage, SDK identifiers, pixels, scripts and comparable technologies in the website and mobile applications. The Privacy Notice explains associated personal-data processing.
2. Categories and our default
Strictly necessary technologies support a service you request, such as secure authentication, remembering a shopping basket, fraud prevention genuinely necessary for the transaction, and recording your privacy choices. The exemption applies to the actual purpose and implementation, not merely a provider's label.
Optional functionality and analytics may remember non-essential preferences or measure product use. Marketing technologies may measure campaigns or support advertising. Under this policy, optional analytics and marketing are disabled until you give valid consent. Declining them must not prevent access to unrelated essential features.
UK law contains limited exceptions beyond strictly necessary use. We will rely on an exception only after checking every applicable condition, giving clear information and providing any required simple means to object. We do not assume PostHog, session recording, advertising measurement or a marketing pixel automatically qualifies. Requirements in other jurisdictions must also be met.
3. Inventory
The table describes the principal technologies and storage categories used by the website and apps. SDK-managed names and lifetimes may vary by platform, version and provider. Provider policies explain their own storage practices; they do not replace our obligations or your privacy choices.
| Technology/name | Provider and domain | Purpose and category | Data accessed/stored | Duration | Consent or specific exemption | Recipient/transfer details |
|---|---|---|---|---|---|---|
cognito_access_token, cognito_id_token, cognito_refresh_token | Guides host / AWS Cognito | Requested sign-in and session security | Authentication tokens | Token expiry within an absolute 30-day user session or 24-hour administrator session from original authentication | Necessary for requested authentication | Guides/AWS; see Privacy Notice |
cognito_oauth_state, cognito_pkce_verifier, cognito_post_login_redirect, guides_auth_challenge, guides_auth_link | Guides host | Requested authentication, return navigation and account-link security | Transaction state and protected short-lived challenge data | Short-lived authentication transactions, normally up to 10 minutes | Necessary for the requested authentication flow | Guides/AWS |
guides_cookie_consent; local storage guides:cookie-consent | Guides host | Remember privacy choices | Categories, notice version and decision time | Cookie and validity of the saved choice: 180 days; local storage may remain physically present until replaced or cleared but cannot silently renew expired consent | Necessary to remember privacy choices | Guides; analytics choice can be synchronized to the authenticated account |
ph_guides_<environment> and associated PostHog local storage/consent keys | Guides host / PostHog EU ingestion | Optional, consent-gated product analytics | Pseudonymous device/session identifiers and allowlisted account/event properties | Analytics cookies: 180 days; browser local storage until cleared or applicable SDK cleanup; identifiable analytics retention policy: 14 months | Analytics consent | PostHog; V2 web client disables session recording, automatic form capture and heatmaps |
| Stripe-hosted Checkout and Connect technologies | Stripe service domains | Requested payment, payout onboarding and provider security | Payment/account and fraud-prevention information processed by Stripe | Provider-managed lifetimes depend on the hosted service and purpose | Assess the specific purpose; optional tracking is not authorized merely by visiting Guides | Stripe; provider notice and Privacy Notice apply |
| Playback resume, completion retry and navigation storage | Guides host | Continue requested playback, retry account-owned progress and recover requested actions | Tour/version/language/Stop identifiers, playback position and retry state; not proof of authorization | Session storage ends with the browser session; local resume/retry data persists until replaced or cleared | Requested service functionality; not marketing authorization | Guides; server access checks remain authoritative |
| Marketing pixels | None currently configured in the inspected web application | No advertising pixel is enabled solely by agreeing to terms | Not applicable | Not applicable | Any future optional marketing technology requires its applicable consent | Not applicable |
| Mobile preferences and offline storage | Guides app / device storage | Remember requested settings, resume playback, retry progress updates and store downloaded Tours | Preferences, Tour/Stop identifiers, playback and progress state, downloaded content and media | Until replaced, removed through app/device controls or cleared by the relevant app lifecycle | Requested functionality; optional analytics has separate controls | Guides; see Privacy Notice |
| Mobile analytics SDK | PostHog | Optional, consent-gated usage analytics | Pseudonymous identifiers and allowlisted interaction/device properties; a limited SDK-managed delivery queue | SDK-managed storage until sent, evicted or cleared; the Privacy Notice explains the identifiable-analytics policy | App analytics consent and applicable operating-system controls | PostHog; V2 clients disable session replay |
| Mobile notification SDKs | Google Firebase / Apple Push Notification service | Deliver enabled notifications | Device/installation identifiers, notification tokens and delivery information | Token lifecycle, app settings and applicable provider storage/deletion processes | Notification permission and applicable privacy requirements; separate from analytics consent | Google/Apple and Guides; see Privacy Notice |
A third-party payment or embedded-media provider may use technologies when you open its service. Its applicable policies explain provider-managed storage, processing locations and controls. Such policies do not replace Guides’ obligations, authorise optional tracking without the required consent or limit your statutory rights.
4. Your choices
The website's Cookie Settings control must let you accept, reject and manage optional categories, with choices that are easy to understand and change. Optional categories are not pre-ticked. Rejecting optional technologies must be as readily available as accepting them. Scrolling or continuing to browse is not treated as valid consent.
You can reopen Cookie Settings to withdraw consent or change preferences. A withdrawal must stop future optional storage/access and trigger appropriate cleanup. Existing third-party or browser data may require additional deletion controls, which we explain. We keep a proportionate record of choices to respect them.
Mobile permissions and operating-system advertising controls are additional tools. They do not replace an appropriate in-app notice or consent process. You can also manage storage in your browser/device settings; blocking essential storage can affect the feature that needs it.
5. No bundled consent
Accepting Terms of Use, creating an account, purchasing a Tour or agreeing to a publishing commitment is not consent to optional analytics or advertising. Consent requests must be specific about purposes and relevant providers. A new provider or materially different purpose may require a new choice.
6. Contact and updates
Email hello@guides.app for cookie or app-tracking questions. We update the inventory and controls when technologies change and obtain any new consent required. Do not rely on a historical cookie list after new tracking is deployed.