Cookies.

Last updated 31 August 2026.

Essential — always on

These two are what UK law calls strictly necessary: without them the thing you asked for does not work. They cannot be turned off, and consent is not required for them.

Both use your browser’s local storage rather than a cookie. Local storage is not sent to our servers with every request the way a cookie is; it stays on your device until it is cleared.

sb-…-auth-token

Set when you log in, so you stay logged in as you move between pages and when you come back later. It holds the token that identifies your session. Removed when you log out. Set by Supabase, which provides our sign-in system.

one.pending-onboarding

Holds the business details you entered while signing up, so they survive the gap between confirming your email address and arriving at your account. Deleted as soon as they have been saved.

one.consent

Remembers which of the two buttons you pressed, so you are not asked again on every page. Ironically the one thing we have to store in order to respect a refusal.

Advertising — only if you accept

We advertise on Facebook and Instagram. If you accept, we load the Meta pixel, which tells Meta that someone who saw one of our ads went on to enquire or sign up. That is what lets us stop paying for ads that do not work.

If you choose Essential only, the pixel is not loaded at all. This is worth being precise about: it is not loaded and then told to stay quiet — the code is never fetched, so there is nothing to set a cookie.

_fbp

Set by the Meta pixel, on our domain. A random identifier that lets Meta connect an enquiry back to an ad. Expires after three months.

_fbc

Set only if you arrived from a Facebook or Instagram ad. Stores the click identifier from that ad. Expires after three months.

What we send with those events is deliberately thin: that a page was viewed, that an enquiry was submitted and which plan it mentioned, that an account was created, that someone reached the payment page and for which plan, and that a plan was started. We do not pass your name, your email address or a hashed version of either, so Meta cannot match the event to a named person from anything we send.

Meta is a separate controller for what it does with this. Its privacy policy is at facebook.com/privacy/policy.

What we do not do

No analytics. No Google Tag Manager, no session recording, no heatmaps, no A/B testing tools. No embedded fonts, maps, video players, chat widgets or social buttons — nothing loads from another company’s server while you read these pages, except the pixel above, and only with your consent.

Changing your mind

Withdrawing consent has to be as easy as giving it, so it is the same two buttons. Use the button at the top of this page, or Cookie settings in the footer of any page.

If you switch from Accept all to Essential only, we delete the _fbp and _fbc cookies and reload the page, so the pixel is gone rather than merely idle. Events already sent to Meta before you changed your mind cannot be recalled by us; you can ask Meta directly using the rights in its own policy.

You can also clear everything from your browser’s settings, usually under privacy, site data or “clear browsing data”. Blocking storage for this site entirely is fine — the pages still work, but you will not be able to stay signed in.

Other sites you are sent to

Paying, and managing your billing, happens on Stripe’s own pages. Stripe sets its own cookies there, including for fraud prevention, and its policy applies rather than ours. See stripe.com/privacy.

Server logs

Separately from anything stored in your browser, our host keeps short-lived request logs that include IP addresses. That is not cookies or tracking — it is how a web server is operated and kept secure. It is covered in our privacy notice.

Questions

Email privacy@kanvas.one and we will answer plainly.