Cookie policy
Version 1.4 (pre-launch). Adds our own cookie-free visit counter and the “Don’t count my visits” switch.
Cookies are small files a website stores in your browser. Websites can also keep information in your browser’s session storage (cleared when you close the tab) or local storage (kept until cleared). This page lists the cookies and browser storage used by PennyForYours.
The short version
- Google Analytics runs on our public information pages for every visitor. Until you choose, and if you decline, it sets no cookies. Google Analytics still receives basic measurement requests without cookies, such as the page, the referring site, your browser type and the time.
- Analytics cookies are optional. Google Analytics sets them only if you accept, for every visitor, including visitors outside the UK.
- We do not show adverts or run Google Ads. We leave analytics off on account, app and form pages. Our fonts are served from our own site.
- Signing in sets one cookie that keeps you signed in. The app sets one more to remember whether you ask, answer or both.
- You can decline analytics cookies and still use the site. The choice is available again through Cookie settings in the footer.
- If you do not choose, the cookie bar hides itself after 15 seconds or once you scroll two-thirds of the way down a page. Hiding it is not consent: analytics cookies stay off, and the bar comes back on your next visit.
- We also count page arrivals ourselves, as anonymous daily totals with no cookies. Don’t count my visits switches off both that count and Google Analytics.
Cookies
| Name | Where | What it does | How long | Type |
|---|---|---|---|---|
pfy_analytics_declined | Public information pages, after you decline analytics cookies | Remembers a refusal even if browser storage cannot save it, so Google Analytics stays cookieless. It holds the notice version. | 6 months, or until you accept analytics cookies or delete it | Consent choice |
_ga | Public information pages, only after you accept analytics cookies; set by Google Analytics | Distinguishes visits so we can count visitors. | Up to 2 years by default, renewed on a visit; your browser may shorten this | Optional analytics |
_ga_<measurement-id> | Public information pages, only after you accept analytics cookies; set by Google Analytics | Keeps the state of a visit so page and interaction counts fit together. | Up to 2 years by default, renewed on a visit; your browser may shorten this | Optional analytics |
__Host-pfy_session | Signed-in app, set by our server when you sign in | Keeps you signed in. It holds a random token; we store only a hash of it. Scripts cannot read it and it is sent only over secure connections. | 7 days for members, 30 days for askers, 12 hours for administrators, or until you sign out | Strictly necessary |
pfy_mode | Signed-in app, set when you choose whether to ask, answer or both | Remembers that choice so the app shows the right home screen. It holds one word: ask, answer or both. | 1 year, or until you change your choice or delete it | Preference (adapts the app to your choice) |
pfy_oauth | Only while you continue with Google or Apple (switched off for now), set by our server | Matches the reply from Google or Apple to the request you started, so nobody else can finish it. It holds random values and the page to return to. Scripts cannot read it. | 10 minutes, and removed as soon as you are back | Strictly necessary |
pfy_no_count | Public pages, only after you turn on “Don’t count my visits” (see Visit counting below) | Records your objection, so our visit counter skips your page requests and Google Analytics does not load at all. It holds the number 1. | 1 year, or until you turn counting back on or delete it | Strictly necessary (records your objection) |
Browser storage
| Name | Where | What it does | How long | Type |
|---|---|---|---|---|
pfy:analytics-erasure:<request> / pfy_erasure_<request> | Local storage, or an essential same-site cookie if storage is unavailable | Delivers a withdrawal request privately to us. Holds a random receipt, the existing Google visit identifier if available, and notice version. Does not contact Google. | Removed on server acknowledgement; pending requests retry on later visits. The fallback cookie lasts up to 6 months | Strictly necessary for your withdrawal request |
pfy:analytics-erasure-receipt | Local storage | Remembers that we received a request. Contains only a random receipt, not the Google identifier. | Until replaced or you clear browser storage | Request receipt |
pfy:analytics-consent | Public information pages (local storage) | Remembers whether you accepted or declined Google Analytics cookies, when you chose, and the notice version. | We ask again after 6 months, or sooner if the notice changes; the browser item remains until replaced or cleared | Consent choice |
pfy:analytics-bar-hidden | Public information pages (session storage), only if the cookie bar hides itself before you choose | Keeps the cookie bar hidden for the rest of your visit. It holds the notice version and records no choice. | Until you close the tab | Cookie bar (no choice recorded) |
pfy:ea-dismissed | All public pages (session storage) | Remembers that you closed the early-access message, so it stays closed. | Until you close the tab | Preference |
pfy:passkey-here | Sign-in page (local storage) | Remembers that this browser has used a PennyForYours passkey, so the sign-in page can offer it straight away. It holds the number 1. | Until cleared | Preference |
pfy:preferences-declined | Site-wide (local storage), only after you object to saved preferences | Stops optional site preferences being saved again until you allow them. | Until you turn the shortcut back on or clear this site’s data | Preference objection |
pfy_preferences_declined | Site-wide (cookie), after you object to saved preferences | Keeps the objection effective if local storage is unavailable. | 6 months, or until you allow saved preferences again | Preference objection |
pfy-from-board | Question board and answer page (session storage) | Returns you to the board if you release a question you opened there. | Removed when the answer page opens, or when you close the tab | Preference |
pfy:admin-toast | Administrator pages only (session storage) | Keeps a confirmation message across a page reload so it can be read out. | Removed as soon as it is shown | Strictly necessary |
pfy:admin-theme | Administrator pages only (local storage) | Remembers the light or dark theme the administrator picked. | Until changed or cleared | Preference |
pfy:admin-shortcuts | Administrator pages only (local storage) | Remembers whether keyboard shortcuts are switched on. | Until changed or cleared | Preference |
When you sign out, the app clears its session storage in that tab.
When we ask for consent
Google Analytics loads on our public information pages for everyone, from the first page you open. Before you choose, and after you decline, the page tells it that analytics and advertising storage are refused. It then sets and reads no analytics cookies, and nothing is used for advertising. Before you choose, Google Analytics receives basic measurement requests without cookies, such as the page, the referring site, your browser type and the time. These requests also carry a random number for that page view, and your IP address reaches Google as with any web request. Google may use such requests in aggregate to estimate visits it cannot measure directly, once its own thresholds are met, so they do not give us a count of every visit. Our lawful basis for these requests is legitimate interests: understanding how people find and use our public pages, including from search engines, so we can improve them.
UK law generally requires consent before analytics cookies, so we ask before using them. Google Analytics cookies are set only with consent, for every visitor, including visitors outside the UK. If you accept, Google Analytics also sets the cookies listed above, so later visits from the same browser can be linked. In both cases it records page views, scrolling, outbound link clicks, video engagement and file downloads on public information pages. Site search and form interaction measurement are switched off. Advertising storage stays off whatever you choose. You can change your choice below.
Other storage supports the service or remembers your choices:
- Strictly necessary. The sign-in cookie and short-lived sign-in and administrator records are needed to sign you in securely and confirm an action.
- Your preferences. Since 5 February 2026 the law also allows a site to store your choices about how it looks or works without asking for consent first, as long as it explains them clearly and gives you a simple, free way to object. That covers
pfy_mode, the early-access message, the passkey shortcut, returning to the question board and administrator settings. The clear-preferences button below stops this storage until you allow it again.
Google’s standard analytics cookies have a default life of two years, although browsers may shorten it. Google explains its GA4 cookies.
Change your analytics choice
The cookie bar at the bottom of our public information pages asks whether Google Analytics may set cookies. If you do not choose, it hides itself after 15 seconds, or once you have scrolled two-thirds of the way down the page, and stays hidden for the rest of your visit in that tab. Hiding the bar is not consent and records no choice: analytics cookies stay off and Google Analytics carries on without cookies, as it does before you choose. The bar shows again on your next visit until you accept or decline. To open it at any time, use Cookie settings in the footer or open cookie settings now.
Use the cookie bar to accept or decline analytics cookies. We ask again after six months or if the notice changes. You can decline or withdraw immediately. We then tell Google Analytics that analytics storage is refused, remove the Google Analytics cookies we can access in this browser, and Google Analytics goes back to requests without cookies. Withdrawing also sends a private deletion request to us using the existing visit identifier, if this browser still has it. If delivery fails, the status message says so and we retry on later visits. Keep browser storage until receipt is confirmed. David submits identifiable requests to Google, which can take up to 63 days after submission to permanently process them. If the identifier is unavailable, we may be unable to find earlier visits. You can also use the support form at any time. We will assess what can still be identified and request deletion from Google where possible; aggregate reports may no longer identify individual visits.
How to object or remove them
- The button clears the mode cookie, early-access dismissal, passkey shortcut, board-return choice and administrator preferences. It also stops optional preferences being saved again until you allow them. The app still works, but you may be asked to choose a mode again.
- You can also delete cookies and site data in your browser settings. Deleting
__Host-pfy_sessionsigns you out. - To object to measurement without cookies, use Don’t count my visits below, or turn on Global Privacy Control in your browser. Either stops both our visit counter and Google Analytics. Declining cookies alone does not stop these requests. You can also tell us through the support form.
- Session storage disappears when you close the tab. The early-access message comes back on your next visit.
Visit counting (no cookies)
We count arrivals at our public pages ourselves, on our own hosting, so we know which pages people reach and roughly where they came from. This counting sets no cookies and runs no script in your browser; it only checks whether you have objected (below). For each page request we add one to a daily total for that page. A total is kept by day, by page address (without anything after a ?) and by a few fixed categories: the kind of source (for example a search engine by name, an AI assistant, social media, email, another website, or unknown), the campaign tag category if the link had one, and whether the request came from a browser, a page loaded ahead of a click, or a bot.
We do not keep your IP address, your browser details, the full address of the page you came from, anything else in the address, any cookie or any identifier, and we do not build a profile or fingerprint of your device. The request is read in memory only to pick the categories, then discarded. The totals cannot tell us who visited or link one visit to another, so they count page arrivals, not people. Totals are kept for 25 months, then deleted automatically.
UK law allows this kind of statistics without consent (the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025, in force 5 February 2026), as long as it is used only to improve our site, is explained clearly and you can object easily and for free. Our reason is our legitimate interest in understanding which pages help people, including visitors who arrive from search engines and AI assistants.
Don’t count my visits
- When the switch is on, this browser stores one small cookie,
pfy_no_count, for a year. Our counter then skips your requests, and Google Analytics does not load at all: no Google script, no measurement requests with or without cookies. It takes effect from the next page you open. - If your browser sends Global Privacy Control, we treat it in exactly the same way, with no cookie needed. Our own counter also skips requests that send Do Not Track.
- Press the switch again to be counted again. Clearing this site’s cookies also turns it off.
- If you accepted analytics cookies before, turning the switch on removes the Google Analytics cookies we can reach. To ask us to delete earlier Google Analytics data, use Decline in Change your analytics choice first, or contact us through the support form.
More about your data
The privacy notice explains what personal data we hold, why, and your rights. PennyForYours is run by David Bryan, a sole trader in the United Kingdom. To ask about cookies or your data, use the Help and support form (no sign-in needed) or email hello@pennyforyours.com.