Legal · Cookies

Cookie Policy

Last updated: 20 September 2026. This page tells you how tamazia.co.uk uses cookies and similar local-storage technologies. Essential first-party storage runs the site. The optional analytics tools, Google Analytics 4 and PostHog, load only after you give analytics consent, and everything they wrote is deleted when you withdraw it. No advertising trackers are set.

1. What is a cookie

A cookie is a small text file stored by your browser on your device when you visit a website. Local storage and session storage are similar mechanisms managed by your browser. Together these allow a site to remember information across page loads.

2. The cookies and storage tamazia.co.uk uses

Name	Type	Set by	Purpose	Duration	Consent needed
`_ga`	Cookie	Google Ireland Limited	The identifier Google Analytics gives this browser so a returning visit is counted as the same device.	400 days	Yes, and deleted when you withdraw
`_ga_<stream>, one per data stream`	Cookie	Google Ireland Limited	Session state for one Google Analytics data stream. Compliance Radar and tamazia.co.uk have one stream each, so a browser that has seen both pages holds both.	400 days	Yes, and deleted when you withdraw
`ph_<project key>_posthog`	Cookie	PostHog, Inc., EU cloud region	The identifier PostHog gives this browser, so a return visit is the same person rather than a new one.	365 days	Yes, and deleted when you withdraw
`ph_<project key>_posthog`	localStorage	PostHog, Inc., EU cloud region	The same identifier, plus the session timeout and the properties registered for this visit.	Until you clear it, or the moment you switch Analytics off	Yes, and deleted when you withdraw
`ph_<project key>_window_id, _primary_window_exists, _session_registered_properties`	sessionStorage	PostHog, Inc., EU cloud region	Tells one browser tab from another within a single visit, so two open tabs are not counted as two people.	The browser tab session	Yes, and deleted when you withdraw
`tamazia-cookie-consent`	localStorage	This site	The choice you made on the banner, in full, including which categories you allowed. Read by every loader on both hosts, which is why one key serves both.	13 months	No, strictly necessary
`tz-consent`	Cookie	This site	The same choice as accept or reject, readable by the server so a page can be delivered consistently with it.	390 days, which is the 13 months above	No, strictly necessary
`__ph_opt_in_out_<project key>`	localStorage	PostHog, Inc.	The record PostHog keeps of whether you allowed it. It holds 0 after a refusal, which is what stops the library resuming on the next page, so it is kept when everything else belonging to PostHog is deleted.	Until you clear site data	No, strictly necessary
`__cf_bm`	Cookie	Cloudflare, Inc.	Distinguishes humans from bots at the edge. No profiling and no cross-site tracking.	30 minutes	No, strictly necessary
`cf_clearance and the Turnstile challenge storage`	Cookie and localStorage	Cloudflare, Inc.	Carries the result of the anti-abuse check that guards the audit and contact forms.	Session, up to 30 minutes	No, strictly necessary
`__cf_bm`	Cookie on cal.com	Cal.com, Inc., through Cloudflare	Bot management for the booking calendar embedded on the demo page.	30 minutes	Set by the embed, on its own domain
`__Secure-next-auth.csrf-token`	Cookie on cal.com	Cal.com, Inc.	Cross-site request forgery protection inside the booking calendar.	The browser session	Set by the embed, on its own domain
`__Secure-next-auth.callback-url`	Cookie on cal.com	Cal.com, Inc.	Where the booking calendar returns you after a sign-in step, if you take one.	The browser session	Set by the embed, on its own domain

The site uses Consent Mode v2 with a default-denied state. Until you accept analytics, Google Analytics 4 and PostHog are not loaded, no request is made to either of them, and they set no storage. After you accept, they load and begin recording. No advertising cookies are set under any circumstances. The 13-month sliding expiry on the consent decision is set per ICO guidance (PECR Reg 6).

Cloudflare Web Analytics is the one third party that runs whichever way you answer, and it appears in no row above because it writes nothing into your browser at all: no cookie and no identifier. Counts page loads and Core Web Vitals. Sets no cookie and stores no identifier in your browser. Its lawful basis is Legitimate interests (UK GDPR Article 6(1)(f)); no consent required because nothing is stored on your device, and it was measured firing on Reject all, which is correct rather than a leak. An earlier version of this page claimed it was consent-gated as well. It is not, and a notice that overstates what is gated is as wrong as one that understates it.

3. The booking calendar, which is a third party and is not loaded until you ask

Every page on this site that offers a calendar offers it as an inline frame served by Cal.com, Inc. While that frame is open your browser is talking to Cal.com directly, and Cal.com sets cookies on its own domain that this site never sees and cannot read.

Until 20 September 2026 that frame loaded on every one of those pages whether you had been asked anything or not, including after you pressed Reject all. It was measured doing so in a browser on 20 September 2026 on five routes across both sites. That is fixed rather than explained: the calendar now loads only when you press the button in its own place on the page, that press is recorded in your browser as tz-booking-embed-consent and lasts for that visit only, and every one of those pages also carries a plain link that opens the same calendar on cal.com and leaves this site instead. If you withdraw consent while the calendar is open it is removed from the page at once.

What Cal.com puts in your browser

Name	Where it is stored	Set by	What it does	How long
`__cf_bm`	Cookie on cal.com	Cal.com, Inc., through Cloudflare	Bot management for the booking calendar embedded on the demo page.	30 minutes
`__Secure-next-auth.csrf-token`	Cookie on cal.com	Cal.com, Inc.	Cross-site request forgery protection inside the booking calendar.	The browser session
`__Secure-next-auth.callback-url`	Cookie on cal.com	Cal.com, Inc.	Where the booking calendar returns you after a sign-in step, if you take one.	The browser session

This site cannot delete these. A page can only expire a cookie on its own domain, so nothing written here can remove a cookie on cal.com, and a notice that implied it could would be untrue. What this site can do is not cause them without asking you, which is now the case, and stop the frame the moment you withdraw, which is also now the case. To remove the three above, clear site data for cal.com in your own browser. Everywhere else on this page, where the storage is on this site's own domain, withdrawing consent does delete it.

What the frame contacts, which is not the same as what this site contacts

app.cal.com · Cal.com, Inc.. The booking calendar frame itself, and the small loader script that mounts it.
cal.com · Cal.com, Inc.. The calendar page the frame navigates to, and the page the plain link opens if you would rather leave this site.
o574544.ingest.us.sentry.io · Functional Software, Inc., trading as Sentry, acting for Cal.com. Cal.com's own error reporting, raised from inside the Cal.com frame. It is not this site's error tracking: no Sentry key is bound on this build, and nothing in this repository loads Sentry. It appears only while the booking calendar is open, and only because you opened it.

4. What we do not use

No Meta Pixel, LinkedIn Insight, X Pixel, or any advertising tag.
No retargeting or behavioural-advertising cookies of any kind.
No browser fingerprinting.
Google Analytics 4 and PostHog load only after explicit consent under Consent Mode v2 with a default-denied state. GA4 runs with IP anonymisation.
No Microsoft Clarity and no Sentry Session Replay. Until 20 September 2026 this page said both loaded after consent. Neither has ever been configured on this site and neither has ever run, so both are named here, once, as things that do not happen rather than left in a list where they looked thorough. The names come from the same list the table above renders from, so this line empties itself the day one of them is switched on.

5. Your choices

When you first visit tamazia.co.uk you will see a consent banner with two equally prominent options: Reject all and Accept all, plus Manage preferences to toggle the analytics category on its own. Choosing Reject all, or leaving the choice unmade, means no analytics storage is set at all: Google Analytics 4 and PostHog stay off and no request reaches either of them. Choosing Accept all, or enabling the analytics toggle, loads them.

You can change or withdraw consent at any time by reopening the banner from the cookie-settings link in the footer, or by clearing site storage in your browser. Withdrawal is as easy as giving consent, and since 20 September 2026 it also deletes. Before that date it did not: withdrawing changed the stored decision and stopped the next load, and left every identifier the earlier consent had written sitting on the device for the next 400 days. Now, the moment you refuse, Google Analytics is sent a denied consent signal, PostHog is told to opt out and forget, and every consent-gated name in the table above is expired from the cookie jar and removed from local and session storage, on this host and on the parent domain the cookies were set against. The record of your decision is kept, because that record is the withdrawal.

6. Lawful basis

Under UK GDPR and EU GDPR the essential storage used by this site is processed on the basis of legitimate interests under Article 6(1)(f). Namely, the operation of the consent mechanism itself, which is required by EU PECR and the UK PECR. The optional analytics storage rests on consent alone, UK GDPR Article 6(1)(a) with PECR regulation 6 for the storage itself, which is why withdrawing it removes the storage rather than merely stopping the next load.

7. Contact

Questions about this policy: founder@tamazia.co.uk. For data-subject requests under UK GDPR / EU GDPR / UAE PDPL, see the privacy notice.