Cookie Policy

About cookies

Cookies are small text files that are placed on your device by the websites you visit. They are widely used to make websites work, to make them work more efficiently, and to provide information to the site's operator. Your browser also has a local storage area, which a site can use to keep a preference on your device. This policy covers both.

How we use cookies

EvoPoint uses a small number of cookies. All but one are strictly necessary to sign you in and keep you signed in; the exception remembers whether the dashboard sidebar is expanded. We do not use cookies to measure how the platform is used, and we do not use them for advertising.

Because we set no analytics or advertising cookies, there is no consent banner. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations. The sidebar cookie holds a single layout preference, is written only inside the dashboard after you have signed in, and can be deleted in your browser at any time without breaking anything.

Cookies we set

Every sign-in cookie below is HTTP-only, which means the pages you view cannot read them, and they are marked Secure in production so they travel only over an encrypted connection. None of them contains a tracking identifier.

• ep_access - your access token. Its lifetime is taken from the token's own expiry, so the browser drops it when the backend stops accepting it.
• ep_refresh - a random, opaque identifier used to renew your access token. Its lifetime is set by our backend when the session is issued.
• ep_intermediate - holds a partially completed sign-in between password entry and two-factor verification. It expires with the short-lived token inside it.
• ep_impersonation - records a support session in which an EvoPoint operator is acting inside your workspace, so the dashboard can show that banner and end the session cleanly.
• ep_sa_access, ep_sa_refresh, ep_sa_intermediate - the equivalents of the three cookies above for the EvoPoint staff administration surface. They are set only for EvoPoint staff and use the stricter SameSite setting.
• ep_wp - a throwaway probe we set and immediately delete to check whether a cookie can be written in the current request. It holds no data about you.

Our authentication cookies carry the SameSite attribute, which stops other websites from causing your browser to send them. Signing in depends on them, so blocking cookies will prevent you from using the dashboard.

One further cookie is written by the dashboard page itself rather than by our servers. It is therefore not HTTP-only, so a page script can read it, and it is not part of signing in.

• sidebar_state - remembers whether the dashboard sidebar is expanded, so the layout is the same the next time you open it. It holds only true or false, it lasts seven days, and it is not used for tracking.

What we keep in your browser

The items below are held in your browser's own storage rather than in a cookie. They are never sent to our servers, they are not used for tracking, and clearing site data removes them.

These are kept on the device until you clear site data.

• evopoint-theme - stores your light or dark mode choice. It is read before the page paints so the interface does not flash.
• ep:sound-prefs - your alert sound settings for the control room dashboard.
• ep:tour-coverage - which parts of the product tour you have already seen.
• evopoint.public-notices.dismissed - which service notices you have dismissed.
• evopoint:reporter:draft:<code> - if you start a report by scanning a QR code, your draft, including any name and contact detail you have typed, is saved on your own device so an accidental refresh does not lose it. It is cleared when you submit the report, and it is never sent to us until you submit.

These are kept only until you close the tab.

• ep:notifications - the recent alerts shown in the dashboard bell, so they survive a page reload during a shift.
• ep:onboarding-banner-dismissed - that you have dismissed the setup prompt for this tab.
• evopoint-sw-cleaned - a marker recording that we have cleared an out-of-date service worker.

Third-party cookies

We do not allow third parties to set cookies on EvoPoint pages.

When you pay, we send you to Stripe's own hosted checkout to enter your card details. Any cookies set there are set by Stripe on Stripe's website, under Stripe's privacy notice, not by us.

How to manage cookies

You can manage cookies directly in your browser by deleting existing cookies and blocking new ones. Most browsers allow you to refuse cookies through their settings, and instructions for the major browsers are available in their respective help centres.

Signing out of EvoPoint deletes the session cookies listed above. Clearing site data in your browser removes both the cookies and the local storage entries.

Changes to this policy

We may update this policy to reflect changes in the cookies we use or in the law. When we do, we will revise the “Last updated” date at the top of this page. If we ever introduce a cookie for analytics or advertising, we will ask for your consent before setting it.

Contact us

For questions about this Cookie Policy, or about how we handle personal data more generally, please email privacy@evopoint.uk. You can find more information about how we process personal data in our Privacy Policy.