Overview
What cookies are and what we use them for.
A cookie is a small piece of text that a website saves on your device so it can recognise you when you come back, or remember what you've already chosen. Some cookies are set by us directly; some are set by services we use, like Google Analytics or Microsoft Clarity, when you've agreed to let them run.
We sort cookies into three categories. You can turn the optional categories on
or off any time, and the choice you made when you first arrived is stored in
a single cookie called heatpass_consent.
- Strictly necessary. Required for the site to work. Always on.
- Analytics. Help us see what's working — Google Analytics 4 and Microsoft Clarity. Off until you turn them on.
- Marketing. Reserved. We don't run any marketing scripts yet, so this category is in the banner for future use only.
Nothing on this page sets a cookie before you've made a choice. If you reject analytics, neither Google Analytics nor Microsoft Clarity ever loads — that means none of the cookies in their sections below get set on your device.
Necessary
Strictly necessary cookies.
These are required for the site to work as you'd expect. They cannot be turned off, because turning them off would break the basic behaviour you're relying on. None of them are used for tracking.
-
heatpass_consent
- Provider
- HeatPass (first-party)
- Purpose
- Stores your cookie choices (which categories you turned on or off) and a session ID that links your cookie to the audit log row created when you made the choice.
- Duration
- 12 months
Analytics
Analytics cookies.
Set only after you've turned the Analytics category on. They help us see which pages are useful and where people get stuck — without them we'd be guessing.
We use two services. Google Analytics 4 gives us page views, traffic sources, and the events we instrument (signup attempts, postcode submissions, and so on). We have IP anonymisation on and Google Signals off, so Google does not use this data to build advertising audiences. Microsoft Clarity gives us session replay and heatmaps — useful for spotting layout problems and confusing copy. Microsoft's terms allow them to use aggregated Clarity data to improve their products; disclosing that here is part of using the service.
Some of the cookies below are first-party (set on heatpass.co.uk) and some are third-party (set by Microsoft on their own domains as part of how Clarity works). We can delete first-party cookies for you when you withdraw consent; the third-party ones live on Microsoft domains and have to expire on their normal schedule. We disclose them all so you know what's happening.
-
_ga
- Provider
- Google (first-party)
- Purpose
- Identifies you as a unique visitor in Google Analytics 4 so repeat visits and pages are connected. We have IP anonymisation on and Google Signals off, so Google does not use your data to populate marketing audiences.
- Duration
- 2 years
-
_ga_4L6DTRP281
- Provider
- Google (first-party)
- Purpose
- Holds Google Analytics 4 session state for our property. The suffix is the GA4 measurement ID; if we ever rotate the property the cookie name changes with it.
- Duration
- 2 years
-
_clck
- Provider
- Microsoft (first-party)
- Purpose
- Microsoft Clarity persistent visitor ID. Lets Clarity link separate sessions from the same device for session replay and heatmaps.
- Duration
- 1 year
-
_clsk
- Provider
- Microsoft (first-party)
- Purpose
- Microsoft Clarity session ID. Used to assemble the events of a single visit into one continuous session replay.
- Duration
- 1 day
-
CLID
- Provider
- Microsoft (third-party (clarity.ms))
- Purpose
- Microsoft Clarity cross-session visitor identifier. Set on the Clarity domain so Microsoft can recognise the same browser across sites that use Clarity.
- Duration
- 1 year
-
MUID
- Provider
- Microsoft (third-party (Microsoft domains))
- Purpose
- Microsoft user identifier. Used by Microsoft across its products, including Clarity. Microsoft has confirmed that aggregated Clarity data may be used to improve Microsoft products — disclosed here per their terms.
- Duration
- 1 year
-
MR
- Provider
- Microsoft (third-party (Microsoft domains))
- Purpose
- Microsoft service-operation cookie used to keep Clarity working correctly.
- Duration
- 1 week
-
SM
- Provider
- Microsoft (third-party (Microsoft domains))
- Purpose
- Microsoft synchronisation cookie. Helps coordinate Clarity activity across Microsoft services that share signals with it.
- Duration
- session
Marketing
Marketing cookies.
None right now. The Marketing category exists in the banner because we expect to add advertising or remarketing tools at some point — most likely Google Ads conversion tracking when paid acquisition starts. Putting the category in the banner now means we don't have to redesign the consent flow when that happens. If a marketing script is added, this section will list it and we'll bump the policy version, which will prompt anyone with an existing consent cookie to make the choice again.
Change
Change your preferences any time.
Open the cookie banner again with the button below, or use the "Cookie settings" link in the footer of any page. Changing your mind is one click — analytics cookies are deleted from this device on the spot if you turn the category off mid-session, and no further requests go to Google or Microsoft until you turn it back on.
If you want to delete cookies that have already been set, your browser also lets you do that directly. Most browsers expose this in Settings under "Privacy" or "Site data" — you can clear cookies for heatpass.co.uk specifically, or for everything.
Contact
Questions about this page.
If something on this page is unclear, or you'd like a copy of the consent record we hold for you, write to hello@heatpass.co.uk and we'll respond within seven working days.
The full privacy policy, with the lawful-basis grid and retention schedule, lives at /privacy. The summary version of what happens to your details is on /trust-and-privacy.