Cookies.

Last updated 21 October 2026.

Essential — always on

These are what UK law calls strictly necessary: without them the thing you asked for does not work. They cannot be turned off, and consent is not required for them.

All of them use your browser’s local storage rather than a cookie. Local storage is not sent to our servers with every request the way a cookie is; it stays on your device until it is cleared.

sb-…-auth-token

Set when you log in, so you stay logged in as you move between pages and when you come back later. It holds the token that identifies your session. Removed when you log out. Set by Supabase, which provides our sign-in system.

one.pending-onboarding

Holds the business details you entered while signing up, so they survive the gap between confirming your email address and arriving at your account. Deleted as soon as they have been saved.

one.consent

Remembers which of the two buttons you pressed, so you are not asked again on every page. Ironically the one thing we have to store in order to respect a refusal.

one.offer

Set only if you arrive from a link carrying a discount code, so the code is still there when you reach the payment page. It holds the code and nothing else, and is removed once payment is set up.

one.free-requested

Set for a moment when you ask for a free example, so the thank-you page knows the form really was sent. Cleared when you close the tab.

one.purchase-tracked

A single flag set after payment, so that reloading the confirmation page cannot report the same purchase to Meta twice. It identifies nothing and is cleared when you close the tab. Only ever set if you accepted advertising cookies.

k1chat:…

Set only if you use the chat button, so your conversation is still there if you reload or come back. It holds a random ticket for that one conversation and nothing else. Removed when you clear your browser’s storage.

k1nocount

Set if you press Reject. It is the flag that tells our visitor count, below, to leave you out. Like one.consent, it exists only to remember a no.

Our own visitor count — on unless you decline

We count visits to this site ourselves. It is not Google Analytics or any other company’s product: each page view is sent to our own server with the page, the site or ad that sent you here, and whether the screen is a phone or a desktop, plus the country and town our host works out from the connection. When you press a button or a link we note the words on it and where it goes, and which box of a form you tap into and how far down the page you scroll, never anything you type. That is all we keep. No IP address is stored, no cookie is set, and nothing is shared with anyone.

k1s

A random string your browser makes when you open a tab here, so the count can tell ten pages read by one person from ten people. It is not a cookie, it is not linked to your name or account even if you are logged in, and it is gone when you close the tab.

Because it is first-party, cookieless and used only to count, it runs without asking first, as UK law allows for a site’s own statistics provided you are told and can say no. Saying no is the Reject button on the card, or Cookie settings in the footer: from then on, nothing is sent.

Advertising

We advertise on Facebook and Instagram. If you accept, we load the Meta pixel, which tells Meta that someone who saw one of our ads went on to enquire or sign up. That is what lets us stop paying for ads that do not work.

If you press Reject, or never answer, the pixel is not loaded at all. This is worth being precise about: it is not loaded and then told to stay quiet — the code is never fetched, so there is nothing to set a cookie.

_fbp

Set by the Meta pixel, on our domain. A random identifier that lets Meta connect an enquiry back to an ad. Expires after three months.

_fbc

Set only if you arrived from a Facebook or Instagram ad. Stores the click identifier from that ad. Expires after three months.

What the pixel sends is deliberately thin: that a page was viewed, that an enquiry was submitted and which plan it mentioned, that an account was created, that someone reached the payment page and for which plan, and that a plan was started. The pixel itself never passes your name or email address.

That is the only way anything reaches Meta from this site. Our server does not send Meta anything about you.

Meta is a separate controller for what it does with this. Its privacy policy is at facebook.com/privacy/policy.

What we do not do

No third-party analytics. No Google Analytics, no Google Tag Manager, no session recording, no heatmaps, no A/B testing tools. The only counting is our own, described above.

No embedded fonts, maps, video players or social buttons. The chat button in the corner is ours too, served from this site and talking only to our server — nothing loads from another company’s server while you read these pages, except the pixel above, and only with your consent.

Changing your mind

Withdrawing consent has to be as easy as giving it, so it is the same two buttons. Use the button at the top of this page, or Cookie settings in the footer of any page. Reject does two things at once: the pixel is never loaded, and our own visitor count leaves you out.

If you switch from Accept all to Essential only, we delete the _fbp and _fbc cookies and reload the page, so the pixel is gone rather than merely idle. Events already sent to Meta before you changed your mind cannot be recalled by us; you can ask Meta directly using the rights in its own policy.

You can also clear everything from your browser’s settings, usually under privacy, site data or “clear browsing data”. Blocking storage for this site entirely is fine — the pages still work, but you will not be able to stay signed in.

Other sites you are sent to

Paying, and managing your billing, happens on Stripe’s own pages. Stripe sets its own cookies there, including for fraud prevention, and its policy applies rather than ours. See stripe.com/privacy.

Server logs

Separately from anything stored in your browser, our host keeps short-lived request logs that include IP addresses. That is not cookies or tracking — it is how a web server is operated and kept secure. It is covered in our privacy notice.

Questions

Email support@kanvas.one and we will answer plainly.