Cookies & storage technologies.

1. What we use

RugWeather currently uses essential authentication/security cookies and browser storage needed to operate requested account and PWA functionality. We do not currently use our own advertising cookies, analytics cookies or cross-site behavioural advertising trackers.

UK rules also cover technologies other than cookies that store or access information on your device, including service-worker Cache Storage. This notice therefore covers both cookies and those similar storage/access technologies.

2. Essential session cookie

When you use an account, RugWeather uses a first-party session cookie to keep you signed in and to associate your requests with your account. This is necessary to provide the account service you request and to protect authenticated actions.

• Production name: __Host-rugweather_session.
• Purpose: authentication, session management and protection of authenticated actions.
• Duration: normally the browser session, subject to the application's session/security behaviour.
• Security: in production it is Secure, HttpOnly and SameSite=Lax. The __Host- prefix is used to restrict how the cookie can be scoped.

3. Remember-me authentication

After successful login or registration, RugWeather currently uses a separate first-party remember-me cookie so that your login can persist between visits. This is set automatically by the current account-authentication flow; there is not currently a separate “remember me” opt-in control.

• Production name: __Host-rugweather_remember.
• Purpose: maintaining authenticated access between visits.
• Duration: approximately 30 days.
• Security: in production it is Secure, HttpOnly and SameSite=Lax.

You can clear cookies through your browser settings. Clearing authentication cookies may sign you out.

4. CSRF and security technologies

RugWeather uses server-side session/security mechanisms and CSRF protection for state-changing forms. The CSRF token used by the current Flask-WTF implementation is associated with the authenticated session; RugWeather does not set a separate named CSRF cookie.

5. Service-worker Cache Storage

RugWeather registers a service worker and uses the browser's Cache Storage to cache the offline page and selected static assets such as CSS and app icons. The service worker deliberately does not cache account-specific HTML pages. This storage is first-party and is used to support the PWA/offline experience, not for analytics or advertising.

Cache Storage is separate from cookies and may remain until the browser or operating system removes site data, the user clears site storage, or RugWeather replaces the cache during a service-worker update.

6. hCaptcha

RugWeather uses hCaptcha on registration for anti-abuse and bot protection. hCaptcha is a third-party service and may load its own scripts or use storage/access technologies when the registration challenge is displayed. Its processing is subject to hCaptcha's own documentation and privacy information.

hCaptcha is used to protect account creation rather than for advertising or behavioural profiling by RugWeather. hCaptcha may process information such as your IP address and challenge/device signals as part of that security check.

7. Stripe hosted pages

When you are redirected to Stripe Checkout or the Stripe Billing Portal, Stripe may use its own cookies or other storage/access technologies. Those technologies are controlled by Stripe rather than RugWeather and are governed by Stripe's own privacy and cookie information.

8. No advertising or analytics cookies

RugWeather does not currently set advertising cookies or use third-party behavioural advertising trackers or analytics tools. If this changes, we will update this notice and obtain consent where required by applicable law before using non-essential storage or access technologies.

The RugWeather Analytics feature is a weather-analysis product feature, not a tracking or advertising analytics system. Opening it does not by itself create an analytics cookie.

9. Your choices

The first-party authentication and security technologies described above are used for functions you request, such as signing in, protecting account actions and using the PWA/offline experience. Blocking them may prevent login, account actions or the PWA/offline experience from working correctly.

Your browser also provides controls for deleting or blocking cookies and other local storage. Blocking a strictly necessary technology can prevent the requested online service from functioning.

10. More information

For information about personal data processed through these technologies, see our Terms & Privacy page.

The ICO's current guidance explains that UK rules cover cookies and other storage/access technologies and that the strictly necessary exception can apply where the technology is essential to provide a service requested by the user.