Cookie Policy
Last updated: 1 November 2026
This policy explains the cookies and similar storage Counterpass uses. A cookie is a small file stored on your device; local storage is a similar browser mechanism. Today we use only strictly-necessary and security items. We do not use analytics, advertising or tracking cookies.
What we use
| Name | Set by | Purpose | Type | Expiry |
|---|---|---|---|---|
| __session, __client, __client_uat, __clerk_* | Clerk (authentication) | Keeps venue users signed in and secures the session. Clerk may add a suffix to these cookie names in production | Strictly necessary / security | Session to 1 year |
| __clerk_environment, clerk_telemetry_throttler (local storage) | Clerk (authentication) | Caches sign-in configuration and rate-limits Clerk's own service telemetry | Strictly necessary / operational | Persistent (until cleared) |
| cp-cookie-consent (local storage) | Counterpass | Remembers that you have seen this cookie notice | Strictly necessary | Persistent (until cleared) |
| cp_dunning_pastdue_dismissed (session storage) | Counterpass | Remembers that a signed-in venue user dismissed the billing-reminder banner (venue dashboard only) | Strictly necessary / operational | Session (until the tab is closed) |
| cp_sound_on (local storage) | Counterpass | Remembers that a signed-in venue user turned on sound on this screen, so the dashboard turns it back on at the first tap after a reload (venue dashboard only). Never set on customer ordering pages | Strictly necessary / operational | Persistent, until sound is turned off or storage is cleared |
| cp_setup_later (local storage) | Counterpass | Remembers which guided-setup steps a signed-in venue user chose to do later on this device, so they stay at the foot of the list after a reload (venue dashboard only). Never set on customer ordering pages | Strictly necessary / operational | Persistent, until the step is put back or storage is cleared |
| cp_manager_unlock_v2 | Counterpass | Remembers that a signed-in venue user has entered the venue's manager code, so protected settings and menu editing stay unlocked on that device for a short time (venue dashboard only). Never set on customer ordering pages | Strictly necessary / security | 15 minutes, or until Lock now is pressed |
| Alerts on your phone: service worker and push subscription (browser storage) | Counterpass, with your browser's own notification service (Apple, Google, Mozilla or Microsoft) | Delivers new-order alerts to a venue user's phone, tablet or computer. Stored only when a signed-in venue user presses Enable under Alerts on your phone (venue dashboard only). Never stored on customer ordering pages | Strictly necessary (a feature you ask for) | Until alerts are turned off on that device, or the device is removed in Settings |
| __stripe_mid, __stripe_sid | Stripe (checkout.stripe.com) | Fraud prevention while you pay. Set on Stripe's own hosted payment pages. Paying redirects you to Stripe; these are not set on Counterpass pages | Strictly necessary / security | Session to 1 year (on Stripe's site) |
| Cloudflare Turnstile (no first-party cookies) | Cloudflare (challenges.cloudflare.com) | Distinguishes humans from bots on the checkout form. Runs inside Cloudflare's own iframe; any state it uses stays in that third-party security context. It sets no cookies or storage on Counterpass pages | Security | Managed by Cloudflare within its iframe |
- __session, __client, __client_uat, __clerk_*
- Set by
- Clerk (authentication)
- Purpose
- Keeps venue users signed in and secures the session. Clerk may add a suffix to these cookie names in production
- Type
- Strictly necessary / security
- Expiry
- Session to 1 year
- __clerk_environment, clerk_telemetry_throttler (local storage)
- Set by
- Clerk (authentication)
- Purpose
- Caches sign-in configuration and rate-limits Clerk's own service telemetry
- Type
- Strictly necessary / operational
- Expiry
- Persistent (until cleared)
- cp-cookie-consent (local storage)
- Set by
- Counterpass
- Purpose
- Remembers that you have seen this cookie notice
- Type
- Strictly necessary
- Expiry
- Persistent (until cleared)
- cp_dunning_pastdue_dismissed (session storage)
- Set by
- Counterpass
- Purpose
- Remembers that a signed-in venue user dismissed the billing-reminder banner (venue dashboard only)
- Type
- Strictly necessary / operational
- Expiry
- Session (until the tab is closed)
- cp_sound_on (local storage)
- Set by
- Counterpass
- Purpose
- Remembers that a signed-in venue user turned on sound on this screen, so the dashboard turns it back on at the first tap after a reload (venue dashboard only). Never set on customer ordering pages
- Type
- Strictly necessary / operational
- Expiry
- Persistent, until sound is turned off or storage is cleared
- cp_setup_later (local storage)
- Set by
- Counterpass
- Purpose
- Remembers which guided-setup steps a signed-in venue user chose to do later on this device, so they stay at the foot of the list after a reload (venue dashboard only). Never set on customer ordering pages
- Type
- Strictly necessary / operational
- Expiry
- Persistent, until the step is put back or storage is cleared
- cp_manager_unlock_v2
- Set by
- Counterpass
- Purpose
- Remembers that a signed-in venue user has entered the venue's manager code, so protected settings and menu editing stay unlocked on that device for a short time (venue dashboard only). Never set on customer ordering pages
- Type
- Strictly necessary / security
- Expiry
- 15 minutes, or until Lock now is pressed
- Alerts on your phone: service worker and push subscription (browser storage)
- Set by
- Counterpass, with your browser's own notification service (Apple, Google, Mozilla or Microsoft)
- Purpose
- Delivers new-order alerts to a venue user's phone, tablet or computer. Stored only when a signed-in venue user presses Enable under Alerts on your phone (venue dashboard only). Never stored on customer ordering pages
- Type
- Strictly necessary (a feature you ask for)
- Expiry
- Until alerts are turned off on that device, or the device is removed in Settings
- __stripe_mid, __stripe_sid
- Set by
- Stripe (checkout.stripe.com)
- Purpose
- Fraud prevention while you pay. Set on Stripe's own hosted payment pages. Paying redirects you to Stripe; these are not set on Counterpass pages
- Type
- Strictly necessary / security
- Expiry
- Session to 1 year (on Stripe's site)
- Cloudflare Turnstile (no first-party cookies)
- Set by
- Cloudflare (challenges.cloudflare.com)
- Purpose
- Distinguishes humans from bots on the checkout form. Runs inside Cloudflare's own iframe; any state it uses stays in that third-party security context. It sets no cookies or storage on Counterpass pages
- Type
- Security
- Expiry
- Managed by Cloudflare within its iframe
Do we need your consent?
Under PECR (as amended by the Data (Use and Access) Act 2025, in force 5 February 2026), strictly-necessary and security cookies do not require consent. Because that is all Counterpass currently sets, we show a brief notice for transparency rather than a blocking consent banner. If we ever introduce analytics or advertising cookies, we will ask for your consent first and block them until you agree.
Your choices
You can review this notice again at any time using the link in the footer, or by adjusting your browser settings to block or delete cookies. Blocking strictly-necessary cookies may stop parts of the service working.
More information
For how we handle personal data more generally, see our Privacy Policy. Questions about this policy can go to privacy@counterpass.co.uk.