Cookies & storage technologies.

1. What we use

RugWeather currently uses essential authentication/security cookies and browser storage needed to operate requested account and PWA functionality. We do not currently use our own advertising cookies, analytics cookies or cross-site behavioural advertising trackers.

UK rules also cover technologies other than cookies that store or access information on your device, including service-worker Cache Storage. This notice therefore covers both cookies and those similar storage/access technologies.

2. Essential session cookie

When you use an account, RugWeather uses a first-party session cookie to keep you signed in and to associate your requests with your account. This is necessary to provide the account service you request and to protect authenticated actions.

• Production name: __Host-rugweather_session.
• Purpose: authentication, session management and protection of authenticated actions.
• Duration: normally the browser session, subject to the application's session/security behaviour.
• Security: in production it is Secure, HttpOnly and SameSite=Lax. The __Host- prefix is used to restrict how the cookie can be scoped.

3. Remember-me authentication

After successful login or registration, RugWeather currently uses a separate first-party remember-me cookie so that your login can persist between visits. This is set automatically by the current account-authentication flow; there is not currently a separate “remember me” opt-in control.

• Production name: __Host-rugweather_remember.
• Purpose: maintaining authenticated access between visits.
• Duration: approximately 30 days after the most recent authenticated use, because the expiry is refreshed while the account remains active.
• Security: in production it is Secure, HttpOnly and SameSite=Lax.

You can clear cookies through your browser settings. Clearing authentication cookies may sign you out.

4. CSRF and security technologies

RugWeather uses server-side session/security mechanisms and CSRF protection for state-changing forms. The CSRF token used by the current Flask-WTF implementation is associated with the authenticated session; RugWeather does not set a separate named CSRF cookie.

RugWeather's versioned mobile API does not use browser cookies for authentication. It requires an access token in the authorisation header and does not set browser authentication cookies on API responses. Native applications should keep issued tokens in the secure storage provided by the operating system.

5. Service-worker Cache Storage

RugWeather registers a service worker and uses the browser's Cache Storage to cache the offline page and selected static assets such as CSS, scripts and app icons. The service worker deliberately does not cache account-specific HTML pages or uploaded horse images. This storage is first-party and is used to support the PWA/offline experience, not for analytics or advertising.

Cache Storage is separate from cookies and may remain until the browser or operating system removes site data, the user clears site storage, or RugWeather replaces the cache during a service-worker update.

6. PWA launch and notification storage

Your morning/evening routine choice, reminder times and decision to skip the routine picker are saved against your account on RugWeather's server, not in a new cookie or advertising identifier. Saving a routine does not itself request notification permission or create a push subscription. Morning and evening prompts are available on Free and Premium; care-reminder, weather-change, fly-risk and heavy-rain/wind alerts require Premium.

The installed PWA uses a first-party session-storage flag to remember that its launch screen has already been shown during the current app/browser session. The flag contains no account, horse, location or advertising information and is not used to track activity across sites.

If you choose to enable app notifications, your browser or operating system records the notification permission and creates a Push API subscription for that device. RugWeather stores the subscription endpoint and cryptographic subscription keys on the server so requested alerts can be delivered. This is used only for service notifications, not advertising or cross-site tracking. You can disable notification categories in RugWeather and can revoke the device permission or clear site data through your browser or operating-system settings.

7. hCaptcha

RugWeather uses hCaptcha on registration for anti-abuse and bot protection. hCaptcha is a third-party service and may load its own scripts or use storage/access technologies when the registration challenge is displayed. Its processing is subject to hCaptcha's own documentation and privacy information.

hCaptcha is used to protect account creation rather than for advertising or behavioural profiling by RugWeather. hCaptcha may process information such as your IP address and challenge/device signals as part of that security check.

RugWeather treats this narrowly scoped anti-abuse use as necessary for account security and fraud prevention. It is not used by RugWeather for advertising, audience measurement or product analytics.

8. Stripe hosted pages

When you are redirected to Stripe Checkout or the Stripe Billing Portal, Stripe may use its own cookies or other storage/access technologies. Those technologies are controlled by Stripe rather than RugWeather and are governed by Stripe's own privacy and cookie information.

9. No advertising or analytics cookies

RugWeather does not currently set advertising cookies or use third-party behavioural advertising trackers or analytics tools. If this changes, we will update this notice and obtain consent where required by applicable law before using non-essential storage or access technologies.

The RugWeather Analytics feature is a weather-analysis product feature, not a tracking or advertising analytics system. Opening it does not by itself create an analytics cookie.

RugWeather records limited first-party product milestones on its server for authenticated accounts. These include account setup progress, whether a first recommendation was successfully viewed, Premium offer and checkout stages, and whether the request came through the browser, installed PWA or API. Event records do not duplicate horse names, saved locations, coordinates, email addresses, passwords or raw weather data. This does not add an analytics cookie or advertising identifier; the existing signed-in session and Stripe's checkout status associate those service actions with the account.

10. Why there is no cookie-consent banner

RugWeather currently uses storage/access technologies only for authentication, account security, fraud prevention and requested PWA/offline functionality. We therefore rely on the applicable strictly necessary or security exceptions rather than consent. We still provide this notice so that the use is transparent.

If RugWeather introduces analytics, advertising, cross-site tracking or another non-essential use, we will first add any consent or objection controls required for that use under the law then in force.

11. Your choices

The first-party authentication and security technologies described above are used for functions you request, such as signing in, protecting account actions and using the PWA/offline experience. Blocking them may prevent login, account actions or the PWA/offline experience from working correctly.

Your browser also provides controls for deleting or blocking cookies and other local storage. Blocking a strictly necessary technology can prevent the requested online service from functioning.

12. More information

For information about personal data processed through these technologies, see our Terms & Privacy page.

The ICO's current storage and access technologies guidance explains that UK rules cover cookies and other storage/access technologies and that an exception may apply where the technology is strictly necessary to provide a service requested by the user.