Cookie Policy
Last updated: 29 October 2026
Cookie Summary
We use cookies to make our website work and to understand how you use it. You can control non-essential cookies through our cookie settings.
1. What Are Cookies?
Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners.
This Cookie Policy explains what cookies are, how we use them, and your choices regarding cookies. This policy complies with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.
2. Types of Cookies We Use
2.1 Essential Cookies (Strictly Necessary)
These cookies are necessary for the website to function and cannot be switched off. They are usually set in response to actions you take, such as logging in or filling in forms.
| Cookie Name | Purpose | Duration |
|---|---|---|
| sAccessToken, sRefreshToken | Our self-hosted sign-in session and renewal cookies. In production these are Secure and HttpOnly. Used for account access, including Google sign-in. | Until sign-out or session expiry; renewal can keep you signed in |
| __Host-tax_2fa | Tax Is Hard: remembers completed two-factor verification for the current sign-in. Secure, HttpOnly and restricted to this host. | Up to 12 hours; sensitive actions require more recent verification |
| tih_mtd_oauth_state | Tax Is Hard: binds the HMRC connection callback to the browser that started it | 10 minutes, or until the callback completes |
Existing Amazon Cognito sign-in also uses browser storage for provider tokens. Self-hosted sign-in uses browser storage for session status, while its authentication tokens remain in HttpOnly cookies. Starting Google sign-in temporarily stores the OAuth state, PKCE verifier and return path in the current tab so we can verify the callback and return you to the right page. These records support sign-in and are separate from analytics consent.
2.2 Optional analytics and interaction recordings
Analytics is off until you allow it. With permission, our own servers receive masked interaction recordings from public pages. No PostHog cookies or third-party replay service are used. Your consent choice is stored in localStorage as cookie_consent and cookie_preferences, with analytics_consent_version recording the current notice version. After consent, replay_session in sessionStorage joins public page interactions in the same tab for up to 15 minutes. It contains a random recording ID, not an account ID, and is cleared when recording is disabled. Recordings expire after 30 days.
Choose Reject analytics to leave recordings off. You can change your choice using Privacy settings in the footer. Do Not Track, Global Privacy Control and the heat map opt-out also disable recordings.
2.3 Functional Cookies
These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.
| Cookie Name | Purpose | Duration |
|---|---|---|
| user_preferences | Stores your display preferences | 1 year |
| calculator_state | Remembers your last calculation inputs | 30 days |
| theme | Light/dark mode preference | 1 year |
2.4 Marketing Cookies
We do not currently use any third-party marketing or advertising cookies. If we introduce marketing cookies in the future, we will update this policy and request your consent before setting them.
2.5 Browser Local Storage
Your cookie preferences are stored locally as cookie_consent and cookie_preferences until you change them or clear browser storage. The sign-in SDK also stores authentication tokens locally; they are removed on sign-out and have provider-controlled expiry and refresh rules. An admin access key, if entered, is kept in this tab's session storage until admin sign-out or the tab is closed. It is not an analytics identifier.
The company calculator stores a recovery copy of your inputs in your browser's local storage. This may include financial figures and is used only to restore work after a refresh or browser crash. It expires after 7 days and is deleted immediately when you dismiss the recovery prompt. Avoid using this feature on a shared device. Local storage is not a cookie and is not sent to us automatically.
2.6 Analytics & Session Replay
We use PostHog for privacy-focused analytics and optional session replay. Analytics/session cookies are only enabled when you accept the Analytics category and Do Not Track is off. Session replay masks input values and text; authenticator secrets and recovery-code sections are excluded from capture.
2.7 Optional Rewarded Ads
Free users may choose to watch an optional rewarded ad to unlock extra usage. No ad or marketing cookies are set unless you start the rewarded ad experience.
3. How to Control Cookies
3.1 Cookie Consent Banner
When you first visit our website, you will see a cookie consent banner. You can:
- Allow analytics: Allow masked interaction recordings
- Reject analytics: Leave interaction recordings off
- Customize: Review and save the analytics preference
3.2 Changing Your Preferences
You can change your cookie preferences at any time by clicking the "Privacy settings" link in the footer of any page, or by clearing your browser cookies and revisiting our site.
3.3 Browser Settings
Most web browsers allow you to control cookies through their settings. You can:
- Block all cookies
- Block third-party cookies only
- Delete cookies when you close your browser
- Browse in "private" or "incognito" mode
Note that blocking all cookies may affect the functionality of our website.
Links to browser cookie settings:
4. Third-Party Cookies
Some cookies are placed by third-party services that appear on our pages. We do not control these cookies. The third parties include:
- PostHog: For privacy-focused website analytics
- Stripe: For payment processing
- AWS Cognito: For authentication
Please refer to the privacy policies of these third parties for more information about how they use cookies.
5. Local Storage and Similar Technologies
In addition to cookies, we may use other technologies to store information locally on your device:
- Local Storage: Used to store your saved calculation scenarios
- Session Storage: Used to maintain state during your session
These technologies are subject to the same consent requirements as cookies.
Anonymous heat map: our own first-party heat map (clicks and scroll depth, never what you type) uses no cookies and stores nothing on your device, so it is not covered by the cookie banner. It turns off with Do Not Track or Global Privacy Control, or from our privacy policy page.
6. Do Not Track
We respect the "Do Not Track" (DNT) browser setting. When DNT is enabled, our analytics tools will not load and no tracking cookies will be set, regardless of your cookie consent preferences. You can also use our cookie consent tools to control tracking independently of DNT.
7. Updates to This Policy
We may update this Cookie Policy from time to time. Any changes will be posted on this page with an updated revision date.
8. Contact Us
If you have questions about our use of cookies, please contact us:
- Email: privacy@tax-is-hard.com
- Company: COGA AI Limited (company number: 16036396)