Summary
We use a small number of essential cookies and similar storage to make the site work and keep it secure. We only use analytics cookies if you accept them. We do not use advertising or social-media tracking cookies, and we do not sell information about your visit. You can change your choice at any time on the cookie settings page.
What cookies are
Cookies are small files a website saves on your device. Similar technologies — such as a browser's local storage and session storage — are covered by the same law (the Privacy and Electronic Communications Regulations 2003, "PECR"), so we list them here too.
Essential cookies and storage
These are strictly necessary to provide the service you ask for — keeping you signed in, protecting your account, remembering your cookie choice and detecting technical faults. The law does not require your consent for them, and you cannot switch them off on our site (you can block them in your browser, but parts of the site will then not work).
Essential (strictly necessary)
| Name | Type | Set by | Purpose | When it is set | How long it lasts |
|---|---|---|---|---|---|
cl-consent | Cookie | Changing Lanes | Remembers whether you accepted or rejected analytics cookies, so we do not ask again on every page. | When you choose in the cookie banner or on the cookie settings page | 180 days |
sb-…-auth-token | Cookie | Changing Lanes (sign-in provided by Supabase, our processor) | Keeps you signed in to the learner, employer or staff area and protects your account. Large sessions are split into numbered parts (.0, .1). | Only when you sign in | Deleted when you sign out; otherwise kept by your browser for up to 400 days. The access token inside it lasts one hour and is refreshed while you use the site. |
sb-…-auth-token-code-verifier | Cookie | Changing Lanes (sign-in provided by Supabase, our processor) | A one-time security value that completes a sign-in link or password reset safely. | Only when you use an emailed sign-in or reset link | Until the sign-in completes (minutes) |
cl-session-transcript | Session storage | Changing Lanes | A short list of the pages you opened and buttons you pressed in this tab in the last 30 minutes, kept on your device so that — only if you choose to report a problem and leave the box ticked — we can see how the fault happened. Never what you type. Nothing is sent unless you send a report. | While you browse (stays on your device) | Deleted when you close the tab; entries older than 30 minutes are dropped |
cl-demo | Cookie | Changing Lanes | Lets invited reviewers open a private demonstration copy of the platform. Never set on the live site. | Only on private demonstration copies, after opening the invitation link | 30 days |
Analytics (optional — only with your consent)
| Name | Type | Set by | Purpose | When it is set | How long it lasts |
|---|---|---|---|---|---|
ph_…_posthog | Cookie | PostHog (EU cloud, acting as our processor) | A random identifier that lets us count visits and journeys (for example how many people start and finish an application) so we can improve the site. Not linked to your name or email; no screen recording; no advertising. | Only after you accept analytics cookies — removed if you later reject them | 180 days |
ph_…_posthog (local storage) | Local storage | PostHog (EU cloud, acting as our processor) | The same analytics identifier and settings, kept in your browser's local storage as a back-up to the cookie. | Only after you accept analytics cookies — removed if you later reject them | Until you reject analytics cookies or clear your browser storage |
Development and test copies only
| Name | Type | Set by | Purpose | When it is set | How long it lasts |
|---|---|---|---|---|---|
cl-dev-staff, cl-dev-learner, cl-dev-employer | Cookie | Changing Lanes | Pretend sign-in for development and test copies that use sample data. The live site refuses to run in this mode. | Only on development and test copies | Until you sign out or close the browser |
Analytics cookies (optional)
With your permission we use PostHog, hosted in the European Union and acting only on our instructions as our processor, to understand how people use the site so we can improve it. It is set up so that it does not record your screen or what you type, does not collect page query strings, masks element details, and is never linked to your name or email address. PostHog may not use the information for its own purposes. If you reject analytics, or later change your mind, no analytics cookies are set and any already set are removed.
Since 5 February 2026, the Data (Use and Access) Act 2025 allows some analytics cookies to be used without consent if people are told about them and can object. We have chosen to keep asking for your consent first.
Counting visits without cookies
Separately, our own server counts page views without cookies or any identifier stored on your device: it records the page template, the referring website's name and a device type. To count unique visitors for one day it uses a one-way scrambled value (a "salted hash") that changes every day and is deleted after the day. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, nothing is recorded. Staff and portal pages are never recorded. This is described in the Privacy notice for website visitors.
Pages run by others
- Stripe hosted checkout. When you pay an invoice you are taken to a payment page run by Stripe on its own website. Stripe sets its own cookies there to process the payment securely and prevent fraud; those cookies are covered by Stripe's own cookie policy, not this one.
Changing your choice
Use the cookie settings page at any time — it is linked from every page. You can also delete cookies in your browser settings; if you do, we will ask about analytics again.
More information
Our Privacy notice explains how we use personal information. Contact [to be confirmed: privacy and data protection email address] with any question. You can find out more about cookies from the Information Commissioner's Office at ico.org.uk.
Change history
| Version | Date | Change | Acceptance needed again |
|---|---|---|---|
| 1.0 | First draft; the cookie table is generated from the same registry as the cookie banner and settings page. | Yes — material change |