This policy explains how PLUMPED LTD uses cookies and similar technologies on the Plumped website at plumped.co.uk and inside the Plumped mobile app.
It sits alongside our Privacy Policy, which explains what we do with the personal data these technologies collect.
1. What we mean by cookies
A cookie is a small text file stored on your device by a website. We also use technologies that work in a similar way:
- local storage and session storage, which store data in your browser;
- software development kits (SDKs), which are pieces of third-party code inside the app that can read and write information on your device;
- pixels and tracking URLs, small images or link parameters used to record that something happened.
Throughout this policy we call all of these "cookies" for simplicity.
2. Your choices
We ask for your consent before we set any cookie that is not strictly necessary. You will see a consent banner on your first visit and a consent screen in the app.
You can:
- accept all, reject all, or choose by category;
- change your mind at any time using the "Cookie settings" link in the website footer, or Settings then Privacy in the app;
- reject non-essential cookies without losing access to the Service.
Rejecting is as easy as accepting. We do not use pre-ticked boxes and we do not treat continued scrolling as consent.
You can also control cookies through your browser settings, and control app tracking through your device settings. On iOS, Settings then Privacy and Security then Tracking. On Android, Settings then Google then Ads.
3. Categories we use
3.1 Strictly necessary
These are required for the Service to work and do not need your consent. You cannot turn them off.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| Session token | Plumped | Keeps you signed in | Session, or 30 days if you choose "remember me" |
| CSRF token | Plumped | Protects forms against cross-site request forgery | Session |
plumped_consent | Plumped | Remembers your cookie choices | 6 months |
| Load balancing | Hetzner | Routes your request to a working server | Session |
3.2 Analytics and performance
These help us understand how people use Plumped so we can improve it. We use them only with your consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes one user from another | 2 years |
_ga_<container> | Google Analytics | Keeps session state | 2 years |
_clck | Microsoft Clarity | Links page views to a single user | 1 year |
_clsk | Microsoft Clarity | Groups page views into a session | 1 day |
CLID, MUID, ANONCHK, SM, MR | Microsoft | Identifies a browser across Microsoft properties for Clarity | Up to 1 year |
| Sentry error context | Sentry | Groups error reports so we can reproduce a crash | Session |
| Crashlytics installation ID | Links crash reports from the same app installation | Until the app is reinstalled |
A note about Microsoft Clarity. Clarity records sessions, which means it can capture how you move around a page and what you interact with. We have configured Clarity to mask text input, and we exclude the skin scan, profile and results screens from recording entirely, so your skin data is never captured in a session recording. If you would rather not be recorded at all, reject analytics cookies.
3.3 Affiliate and attribution
These record that you clicked through to a retailer, so our partners can pay us the commission we are due. They do not build an advertising profile of you. We use them only with your consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
Awin click identifier (awc parameter and related cookies) | Awin Ltd | Records which link you clicked so a purchase can be attributed to Plumped | Up to 30 days, depending on the retailer |
If you reject this category, the links still work and you can still buy the product. We simply will not be paid.
More detail is in our Affiliate Disclosure.
3.4 Marketing
We do not currently run advertising cookies or advertising pixels on plumped.co.uk or in the app.
If we introduce them, we will update this policy, ask for your consent before setting them, and never use your skin data or health information for advertising purposes.
4. Cookies set by others
Some cookies above are set by third parties who decide for themselves how to use the data they collect. Their own policies apply in addition to ours:
- Google: policies.google.com/privacy
- Microsoft: privacy.microsoft.com
- Awin: awin.com/gb/privacy
- Sentry: sentry.io/privacy
- Apple: apple.com/legal/privacy
- Hetzner: hetzner.com/legal/privacy-policy
We have no control over cookies set on the retailer and brand websites we link to. Read their policies before continuing on those sites.
5. International transfers
Some of these providers are outside the United Kingdom and the European Economic Area. Where data leaves the UK or the EEA we rely on Standard Contractual Clauses with the UK International Data Transfer Addendum, or on the EU-US Data Privacy Framework and its UK Extension where the recipient is certified. See section 8 of the Privacy Policy.
6. Legal basis
Under the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025, and under Article 5(3) of the EU ePrivacy Directive as implemented in your country, we must obtain your consent before storing or accessing information on your device, unless it is strictly necessary to provide a service you have requested.
Some low-risk analytics are now exempt from the consent requirement in the UK. We have chosen not to rely on that exemption, and we ask for consent for all non-essential cookies. We think that is clearer, and it keeps our UK and EU practice the same.
Once consent is given, our lawful basis for the resulting processing of personal data is your consent under Article 6(1)(a) of the UK GDPR and the EU GDPR.
7. How long we keep the data
Durations for each cookie are in the tables above. The personal data collected through them is retained as set out in section 9 of the Privacy Policy: analytics data for up to 14 months, session recordings for 30 days, crash and diagnostic logs for 90 days.
8. Keeping this list accurate
Cookies change as we change our tools. We review this list at least every six months and whenever we add or remove a provider.
If you find a cookie on our site that is not listed here, please tell us at operations@plumped.co.uk so we can correct it.
9. Contact
Questions about this policy: operations@plumped.co.uk
PLUMPED LTD, 124 City Road, London, England, EC1V 2NX. Company number 16204649.