Cookie Policy — TrueBooks

This Cookie Policy explains what cookies and similar technologies TrueBooks uses, what they do, and the choices you have. It supplements our Privacy Notice and forms part of our Terms of Service.

We comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) as amended, and with the UK GDPR. The cookies our own Service sets are strictly necessary and, under PECR Regulation 6(4), do not require your consent. In addition, we use one optional, consent-based category: Google advertising-measurement cookies that tell us which of our own adverts led to a sign-up. These are set only if you choose “Accept” on the cookie banner shown on your first visit; choosing “Essential only” (or doing nothing) keeps them off. We do not use cross-site behavioural-tracking or third-party analytics cookies.

1. What is a cookie?

A cookie is a small text file that a website places on your device when you visit. Cookies are widely used to make websites work efficiently, to remember preferences and to keep users signed in securely. Some technologies that are not strictly cookies — such as local storage and session storage — have similar effects and are covered by the same rules. For brevity we refer to all of them as “cookies” below.

2. Categories of cookie under PECR

Strictly necessary — required for the service you are using; no consent needed under PECR Regulation 6(4). All cookies set by our own Service fall into this category.
Functional — remember preferences (e.g. dark/light theme). We use one functional cookie, which we treat as strictly necessary for an essential preference you have actively chosen.
Analytics — statistical insights into how the site is used. We collect anonymous, server-side aggregate analytics on public marketing pages only; this uses no cookies and writes only a hashed IP server-side. See the Privacy Notice Section 2.2.
Advertising measurement (consent-based) — with your consent, Google’s tag sets cookies (e.g. _gcl_au) so that a sign-up can be attributed to the TrueBooks advert that brought you here. Used for measuring our own advertising only; off by default and gated behind the cookie banner. Without consent the tag operates in Google’s “Consent Mode” with cookieless pings only. We do not use cross-site behavioural-tracking cookies.

3. The cookies we set

The following cookies may be set in your browser when you use TrueBooks.

Cookie	Purpose	Lifetime	Category
`__Secure-next-auth.session-token` (or `next-auth.session-token` on http localhost)	Keeps you signed in. Set after a successful login; cleared on sign-out.	30 days	Strictly necessary
`__Host-next-auth.csrf-token`	Cross-site-request-forgery (CSRF) protection on auth requests.	Session	Strictly necessary
`__Secure-next-auth.callback-url`	Stores the URL to return to after sign-in.	Session	Strictly necessary
`__Host-next-auth.pkce.code_verifier` / `__Host-next-auth.state`	Securely completes OAuth sign-in (Xero, Google).	15 minutes	Strictly necessary
`__Host-tb-2fa-trust`	Optional. Remembers a trusted device so you do not have to re-enter a two-factor code each time you sign in from it. Set only if you tick “Remember this device for 30 days” at the 2FA prompt; can be revoked from Settings → Security at any time.	30 days	Strictly necessary (security)
`__Host-tb-imp`	Set only when a TrueBooks administrator is viewing your account in read-only support mode (impersonation). Time-limited to 15 minutes. Has no effect on, and is never set by, a regular user.	15 minutes	Strictly necessary
`tb_theme`	Remembers your dark/light theme preference so the page renders without a flash of the wrong colour on the next visit.	1 year	Strictly necessary (functional)
Amazon / Xero / Alibaba / eBay OAuth state cookies	Short-lived state values used during the OAuth handshake when you connect a third-party platform.	10–15 minutes	Strictly necessary
`_gcl_au` (and related `_gcl_*` Google cookies)	Set by Google’s tag only after you choose “Accept” on the cookie banner. Links a sign-up back to the TrueBooks advert that brought you here (conversion measurement). Never set if you choose “Essential only”.	90 days	Advertising measurement (consent-based)

4. Local / session storage

We use the browser’s localStorage and sessionStorage to keep small, non-sensitive UI state on your device, such as:

The result of the last integrity-check / duplicate-scan you ran, so it survives page reload;
The state of the multi-step signup wizard (24-hour TTL, password never saved);
Filter, sort and column-visibility preferences on data tables;
tb_consent — your cookie-banner choice (“granted” or “denied”), so we do not ask again on every visit. Clearing it (see Section 6) makes the banner reappear.

These values are stored only on your device, are not transmitted to our servers, and are cleared when you sign out or clear site data.

5. Cookies set by third parties on our pages

We embed a small number of third-party scripts that may set their own cookies on TrueBooks pages:

Google tag (gtag.js) — loaded site-wide for advertising measurement, but configured with Google’s Consent Mode v2 so that no advertising cookies are set unless you choose “Accept” on the cookie banner. Without consent the tag sends cookieless, aggregated pings only. Google’s use of the data is governed by Google’s cookie policy.
Stripe.js — loaded only on the billing checkout and update-card surfaces. Stripe.js may set strictly-necessary cookies inside its own js.stripe.com iframe for security and fraud prevention. Those cookies are governed by Stripe’s cookie policy.
Chatwoot — the live-chat widget is loaded only when you elect to open it. It may set strictly-necessary cookies on its own app.chatwoot.com origin to maintain the conversation state. Those cookies are governed by Chatwoot’s own policy.

6. Controlling cookies

Advertising-measurement cookies are entirely under your control: they are off until you choose “Accept” on the cookie banner, and you can withdraw that consent at any time — withdrawal is as easy as giving it. Click the button below to clear your stored choice (Consent Mode reverts to denied immediately and the banner is shown again):

The remaining cookies we set are strictly necessary for the Service to function, so blocking them may prevent you from signing in or completing key actions. You can nevertheless control cookies through your browser settings:

Chrome: support.google.com/chrome/answer/95647
Safari: support.apple.com/en-gb/guide/safari/sfri11471/mac
Firefox: support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Edge: support.microsoft.com/en-us/microsoft-edge/

To revoke the optional “Remember this device for 30 days” trust cookie, sign in and go to Settings → Security → Trusted Devices and click Revoke Trust on the device you want to remove.

7. Do Not Track

We do not perform cross-site behavioural tracking, regardless of the Do-Not-Track (DNT) header value. The only advertising-related processing we do is consent-based measurement of our own adverts (Section 5), which stays off unless you opt in via the cookie banner — so DNT does not change our behaviour beyond the choices already under your control.

8. Changes to this policy

If we add a new cookie or change how existing cookies are used, we will update this page with the new “Last updated” date and, where the change is material, notify signed-in users by email or in-app banner.

9. Contact

Questions about cookies should be addressed to support@truebooks.co.uk.

Trademarks and non-affiliation

TrueBooks is an independent third-party solution. TrueBooks is not affiliated with, endorsed by, sponsored by, or otherwise associated with Amazon.com, Inc. or any of its subsidiaries. Amazon, Amazon Seller Central, Selling Partner API, FBA, and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates. Xero is a registered trademark of Xero Limited. All other trademarks are the property of their respective owners. See our Amazon disclaimer for more detail.