Cookie and device storage policy

1. What this policy covers

This policy covers cookies and every equivalent technology we use to store information on, or read information from, your device. That includes browser local storage, which the law treats in the same way as a cookie. It applies to tru-network.com and to every hosted TRU Card profile.

We group storage into two kinds. Strictly necessary storage is what a service cannot work without, such as keeping you signed in; the law does not require consent for it, and it cannot be switched off without breaking the service. Optional storage requires your consent before it is placed, and you may withdraw that consent at any time.

2. TRU Card profiles

Opening a TRU Card stores nothing on your device and creates no record of your visit until you answer the banner. No cookies are set on a card page at all.

Your consent choice — optional, stored only after you answer

• What it is: a single local storage entry recording your answer, the card it relates to, the version of this policy you were shown, and the date
• Why: so that you are not asked again every time you open the same card
• How long: 12 months, after which we ask again
• If you decline: your choice is recorded in the same way so that we can honour it, no measurement takes place, and the card remains fully functional

Your choice is recorded for each card separately, so consenting on one person’s card does not consent on anyone else’s.

3. This website and signed-in areas

Browsing the public pages of tru-network.com sets no cookies. The following strictly necessary items are used only once you sign in:

• Session cookie. Holds your signed-in access token so that protected pages recognise you. It is restricted to tru-network.com, sent only over HTTPS, marked to limit cross-site sending, and expires after one hour.
• Session storage in your browser. Holds your authenticated session and its automatic renewal, and the list of accounts you have chosen to remember on that device.
• Multi-factor authentication state. Short-lived entries that carry you through the verification step and return you to the page you were heading for.

These are exempt from the consent requirement because the signed-in service cannot be provided without them. Signing out, or clearing site data in your browser, removes them. We use no analytics, advertising or profiling storage anywhere on this website.

4. What we measure, and what we do not

The person whose card you have opened receives a report on how their card is performing. Where you have consented, we record the card opened, whether the interaction was a view or a tap, the link selected, the route by which you arrived, the page address with any query string removed, and the time. We also record the country reported by our network provider.

We deliberately do not record more than that:

• Your IP address is not stored. It is converted to a keyed irreversible value inside our edge service, used only to stop abuse and inflated counts, and the address field on the record is stored empty
• We use no IP geolocation service, and we do not record your town, city or region
• We do not ask for your name or email address, and no record is linked to you as an identified individual
• We do not track you across other websites, and we do not build a profile of you

Engagement records are deleted automatically 395 days after they are created. Abuse-prevention records are deleted after 30 days.

5. Third parties

We use none. There is no advertising, no third-party analytics, no social media tracking and no cross-site tracking anywhere on our sites. We do not sell or share your data, and no third party is permitted to set storage on your device through our pages.

6. Withdrawing or changing your consent

Select Privacy choices in the footer of any card. A change takes effect immediately, and the card remains fully functional either way. Clearing your browser data for the site also removes your recorded choice, in which case you will be asked again the next time you open a card.

You can also block or delete cookies and site data through your browser settings. Blocking the strictly necessary items in clause 3 will prevent you from signing in.

7. Contact

TRU Network Ltd is registered in England and Wales under company number 16032929, at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Please write to privacy@tru-network.com with any question or data protection request. Our privacy policy sets out how we handle personal data more generally. You may also raise a concern with the Information Commissioner’s Office at ico.org.uk.