In force 12 August 2026.
The short version
We set the cookies needed to make the site and the app work, plus a small amount of privacy-friendly analytics so we can see which pages are doing their job. We do not set advertising cookies, we do not run third-party trackers, and we share nothing with ad networks. Analytics only runs if you accept it.
What we set
| Cookie | Purpose | Type | Expires |
|---|---|---|---|
| ots_session | Keeps you signed in | Strictly necessary | Session |
| ots_csrf | Protects forms against cross-site request forgery | Strictly necessary | Session |
| ots_consent | Remembers your cookie choice | Strictly necessary | 12 months |
| ots_theme | Remembers light or dark preference | Functional | 12 months |
| ots_tenant | Keeps you in the right company when you belong to more than one | Functional | 30 days |
| _analytics_id | Counts unique visits without identifying you | Analytics — opt-in | 14 months |
Strictly necessary cookies do not require consent because the service cannot work without them. Everything else does, and defaults to off.
Inside the app
The staff app does not use cookies. It stores a session token and cached shift data locally on the device so it keeps working with no signal. Signing out removes both; deleting the app removes everything.
Controlling cookies
Change your choice at any time from the cookie link in the footer, or block and delete cookies in your browser settings. If you block the strictly necessary ones, signing in will stop working — that is not us being difficult.
We honour Global Privacy Control. If your browser sends that signal we treat it as a refusal of analytics and do not ask again.
Changes
If we add a cookie we update this table and, where consent is required, ask before setting it. See also our privacy notice.