Towsty - Is a heat pump worth it for my home?

This Cookie Policy explains how Towsty uses cookies and similar technologies when you use our website and portals. It should be read alongside our Privacy Notice.

What are cookies?

Cookies are small text files stored on your device. They can make a website work, keep you signed in, remember your choices, and — where you consent — help measure advertising and understand how people use the site. Similar technologies, such as pixels and browser storage, can perform related functions.

How we use cookies and browser storage

We use cookies and browser storage for the purposes described below. Some are strictly necessary and do not require consent. We ask for your consent before loading Google Ads, Meta Pixel, and Hotjar. You can use Towsty if you reject those services.

Strictly necessary cookies

These cookies and identifiers are set by Towsty, our authentication provider Supabase, or Stripe, which provides installer identity-verification and payment services:

Cookie	Purpose	Duration
towsty_cookie_consent	Records whether you accepted or rejected optional cookies, so we can respect your choice.	365 days
towsty_session_id	Links your answers to your anonymous heat-pump estimate while you complete the assessment.	24 hours
towsty_saved_estimate_token	Securely opens the saved estimate linked from your email.	90 days
sb-<project-ref>-auth-token and sb-<project-ref>-auth-token-code-verifier (may be split into numbered cookies)	Maintains a secure signed-in session and completes passwordless sign-in through our authentication provider, Supabase.	Authentication cookies may remain for up to 400 days; the verification cookie is removed after sign-in completes
Stripe fraud-prevention cookies and identifiers, including `__stripe_mid` and `__stripe_sid`	Secures installer identity verification, card setup, and payments and helps Stripe detect and prevent fraud.	Typically one year for the device identifier and 30 minutes for the session identifier

For current details about Stripe's technologies, see Stripe's Cookie Policy.

Optional advertising and behaviour-analytics technologies

If you select Accept all, we load the third-party services below. If you select Reject non-essential, we do not load them.

Provider and technology	Purpose	Typical duration
Google Ads `_gcl_*` cookies and `_gcl_ls` local storage	Attributes visits and completed enquiries to advertising, measures campaign performance, and supports remarketing.	Cookies: up to 90 days. Local storage has no automatic browser expiry and remains until Google or you clear it
Meta (Facebook) Pixel `_fbp` and, after an ad click, `_fbc`	Measures page views and completed enquiries, and helps Meta attribute them to advertising.	Up to 90 days
Hotjar `_hjSessionUser_6743939`, `_hjSession_6743939`, other `_hj*` cookies, and browser local/session storage such as `hjActiveViewportIds` and `hjViewportId`	Produces heatmaps, session recordings, and surveys so we can understand and improve the website experience.	30 minutes for a session; up to 365 days for the site-specific user identifier; session storage lasts for the current tab; local storage remains until Hotjar or you clear it; capability-test values are deleted almost immediately

For more detail, see Google's advertising cookie information, Meta's Cookie Policy, and Hotjar's cookie list.

Embedded Google Maps

During the heat-pump assessment, we use an embedded Google Map to show the property you selected. When the map loads, your browser connects directly to Google and sends the selected property address or coordinates in the map request, together with technical information such as your IP address, browser information, and the Towsty page displaying the map.

Depending on your browser and Google settings, Google may read existing Google cookies and set or update cookies and similar identifiers for functionality, security, analytics, personalisation, and advertising. Durations vary: for example, Google states that NID lasts for six months, while _Secure-ENID and SOCS last for 13 months. The map is not controlled by Towsty's optional-cookie choice. You can block or remove Google cookies in your browser, although the map may then work differently.

See Google's information about cookies and Google's Privacy Policy.

Cookieless service analytics

We also use Vercel Web Analytics and Speed Insights to understand website usage, journey performance, and technical performance. Towsty sends Vercel page views and custom events about assessment and installer-journey steps and outcomes. Event details can include a full postcode, an internal assessment identifier, campaign parameters, and a Google click identifier. We do not send names, email addresses, or phone numbers in these events.

These services do not set cookies. Vercel Web Analytics distinguishes daily visitors using a hash that resets each day and cannot be used to track a person across websites. Because these services do not store or read optional cookies on your device, they are not controlled by the cookie choice above.

First-party session storage

Towsty uses browser session storage in the current tab to keep journeys working and avoid duplicate events. This includes:

towsty_acquisition_attribution and towsty_homeowner_acquisition_attribution — retain campaign parameters, including UTM values and Google click identifiers, so an enquiry or installer application can be attributed to its source;
towsty_installer_join_started and towsty_installer_join_step_viewed:* — avoid recording duplicate installer-journey events;
towsty_ads_conversion_pending, towsty_ads_installer_apply_pending, and towsty_fb_lead_pending — hold a pending conversion marker until the relevant advertising service is permitted; and
towsty:pending-lead-purchase — resumes an installer payment after authentication.

Pending conversion and payment markers are removed when they are used. Attribution and installer-journey dedupe keys remain until you close the browser tab.

Error monitoring and session replay

We use Sentry to detect technical errors, monitor performance, and sample session replays so we can diagnose problems. Sentry uses sentryReplaySession in browser session storage to maintain replay state in the current tab. Replay recording pauses after five minutes without activity. The replay session expires after 15 minutes without activity, after a maximum of 60 minutes, or when the tab is closed. Sentry is not controlled by the optional-cookie choice described above. See Sentry's Privacy Policy.

How to change your mind

You can change or withdraw your consent at any time. Select Manage cookies in the website footer where it is shown, or Manage cookie preferences on this page when optional cookies are offered, then choose Accept all or Reject non-essential again.

If you withdraw consent, Towsty records your choice as “denied”, stops loading the optional services, and refreshes the page where needed. Cookies already stored on your device may remain until they expire or you remove them using your browser settings, but Towsty will not load the optional services to read or update them.

If neither control is shown, optional cookies are not enabled in that environment.

Changes to this policy

We may update this Cookie Policy when our use of cookies or service providers changes. We will update the date shown at the top of this page when we make material changes.

More information

For information about how we use personal data and your rights, see our Privacy Notice.