Legal
Cookie policy
Last updated October 31, 2026
This policy lists the cookies and similar technologies (browser storage, scripts that read information from your device) used on hovermarks.co.uk, hovermarks.com and the Hovermarks platform at inspect.hovermarks.com. They are operated by BrainBoxIT Limited, trading as Hovermarks. For how we handle personal data generally, see our privacy notice.
We follow regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) and the ICO's guidance on storage and access technologies: anything that is not strictly necessary for a service you asked for is used only after you opt in.
Your choices on our websites
On your first visit a consent window offers Reject all, Customize and Accept all. Reject all and Accept all are equally prominent, and nothing optional is switched on until you choose it. Your choice is stored on your device for 12 months, after which we ask again.
You can change your mind at any time from Cookie preferences in the footer
of every page. If you withdraw Marketing consent we stop Google Ads measurement
straight away and delete the Google Ads cookies set on our domain. Cookies that
Google set on its own domain (doubleclick.net) can only be removed from your
browser settings.
On hovermarks.com, if your browser sends a Global Privacy Control signal we record that as Reject all.
Websites: strictly necessary (always on)
| Name | Provider | Purpose | How long |
|---|---|---|---|
ARRAffinity, ARRAffinitySameSite | Microsoft Azure (us) | Load-balancer affinity: keeps your requests on the same server. | Until you close the browser |
hovermark.cookie-consent.v1 (local storage) | Us | Records your cookie choice and when you made it. | 12 months |
cf_clearance, __cf_bm | Cloudflare | Security: set by Cloudflare's network only if it needs to challenge a request that looks automated. | __cf_bm 30 minutes; cf_clearance up to 1 year |
| Cloudflare Turnstile | Cloudflare | Bot check on the contact and waitlist forms. It runs in a Cloudflare frame on pages with a form and receives your IP address and browser details. | For the check only |
Websites: analytics (only if you tick Analytics)
| Name | Provider | Purpose | How long |
|---|---|---|---|
| Plausible Analytics script | Plausible (EU-hosted) | Aggregated page-view counts. Sets no cookies and stores nothing on your device. Your IP address is used to make a daily-rotating anonymous count and is not stored. | Nothing stored on your device |
Websites: marketing (only if you tick Marketing)
Nothing from Google loads until you tick Marketing. When you do, the Google Ads
tag (account AW-18219684837) loads with Google Consent Mode, sends no page
views, and has remarketing and ad personalisation switched off. It records a
conversion when you start a trial, send the contact form or join the waitlist.
| Name | Provider | Purpose | How long |
|---|---|---|---|
_gcl_au | Google (on our domain) | Links a conversion to the ad click that brought you to the site. | 90 days |
_gcl_aw | Google (on our domain) | Stores the ad-click identifier when you arrive from a Google ad. | 90 days |
_gcl_ls (local storage) | Google (on our domain) | Google tag's record of the ad-click data above. | 90 days |
IDE | Google (doubleclick.net) | Google's advertising cookie, used to measure the conversion. | About 13 months |
test_cookie | Google (doubleclick.net) | Checks whether your browser accepts cookies. | 15 minutes |
The Hovermarks platform (inspect.hovermarks.com)
The platform uses only strictly necessary storage, so it does not show a consent window. It runs no analytics, advertising or tracking scripts.
| Name | Purpose | How long |
|---|---|---|
__Host-authjs.session-token-inspection | Keeps you signed in. | Until you sign out or the session ends |
__Host-authjs.csrf-token-inspection, __Host-authjs.callback-url-inspection and short-lived sign-in cookies (state, PKCE verifier, nonce) | Protect sign-in against forgery and return you to the right page. | The sign-in, or the browser session |
| Invitation cookie | Carries an invitation through sign-up. | 10 minutes |
hm_signup_currency | Remembers the billing currency chosen on our pricing page during sign-up. | 1 hour |
| Local storage and the app's offline cache (service worker) | Remember small settings (for example a dismissed install prompt), hold an inspection you are submitting if the signal drops, and cache the app's own files so it loads quickly. | Until you clear your browser data |
cf_clearance, __cf_bm | Cloudflare security, as above. | As above |
| Cloudflare Turnstile | Bot check on the public fault-report form on QR scan pages. It starts when you begin filling in the form, not when the page opens. | For the check only |
Changes
We update this policy whenever we add, remove or change a cookie or similar technology. This policy was last updated on 1 November 2026.
Questions: privacy@hovermarks.com.