Legal
Cookie policy
This is a draft and requires legal review before launch. It was written to be honest and usable rather than to be comprehensive, and it has not been checked by a solicitor. It is not in force, because the service is not yet being sold.
If you are relying on this for a real decision, write to [email protected] and ask us where it stands.
Last updated . A UK company is being incorporated to operate this product
Every cookie QubeRoute sets is listed below. There are four, they are all ours, and none of them tracks you.
Why there is no cookie banner
Under the Privacy and Electronic Communications Regulations, consent is needed for cookies that are not strictly necessary for a service the user asked for. Every cookie we set is strictly necessary, so there is nothing to ask you about.
This website sets no cookies at all until you sign in. Reading the marketing pages, the documentation or this policy sets nothing. The four below appear only inside the signed-in dashboard.
| Name | What it is for | How long | Category |
|---|---|---|---|
| deeplink_session | Keeps you signed in. Holds a random token, never your details. | 30 days, or until you sign out | Strictly necessary |
| deeplink_environment | Remembers whether you are looking at live or test. | 1 year | Strictly necessary |
| deeplink_app | Remembers which app you last chose, so the switcher returns to it. | 1 year | Strictly necessary |
| deeplink_organisation | Remembers which organisation you are working in, if you belong to more than one. | 1 year | Strictly necessary |
How they are set
All four are:
- HttpOnly — JavaScript in the page cannot read them, so a script injected into the page cannot steal your session;
- Secure — sent only over HTTPS in production;
- SameSite=Lax — not sent on requests started by another website, which blocks cross-site request forgery, while still being sent when you follow a link to us from an email.
What we do not set
No advertising cookies, no analytics cookies, no third-party cookies of any kind. We run no third-party JavaScript on this site — the Content Security Policy would refuse it — so no other party is in a position to set one.
Turning them off
You can block cookies in your browser. Blocking deeplink_session means you cannot stay signed in, because staying signed in is what it does. The other three only affect what the dashboard remembers between visits.
Questions
Write to [email protected]. See also the privacy policy, which covers everything else we hold.