Cookie policy

What we set

GrabAName sets strictly necessary cookies, which the service needs in order to work, and Google Analytics cookies only if you accept them. Nothing is loaded from Google, and no Google cookie is set, until you press Accept on our cookie banner.

Strictly necessary cookies

These are essential to provide the service you asked for, so consent is not required for them under PECR.

• Supabase authentication cookies (sb-…-auth-token) keep you signed in, for as long as you stay signed in.
• gan_currency remembers the currency you see figures in — set from your country for the length of your visit, and kept for a year once you choose a currency yourself in the footer.
• gan_consent remembers whether you accepted or declined analytics cookies, so that we can honour your choice. It holds that answer and nothing else, and is kept for six months, after which we ask again.
• gan_sent_signin and gan_sent_report hold the email address we have just sent a sign-in link to, so that the page can tell you where it went and accept the one-time code — without your address appearing in the page’s web address. Each is encrypted, cannot be read by scripts on the page, is sent only to the page that uses it (the sign-in page and the new-report page), and expires after one hour, or as soon as you sign in or sign out.
• gan_pending keeps a form you filled in before signing in, encrypted, for up to an hour, so that you do not have to type it again. It is used once and then deleted, and only for the account its sign-in link was sent to.
• gan_handoff carries the business name and email you enter in the homepage’s “Get started” card to the report form, encrypted, for ten minutes at most. It is deleted when you send the form.

Analytics cookies — only if you accept

If you press Accept, we load Google Analytics 4 to count visits and see how the site is used, and these cookies are set:

• _ga tells one browser from another, so that visits can be counted. It expires after two years.
• _ga_TF398H3C4F keeps track of your current visit. It expires after two years.
• gan_ga_events is our own: when you sign in, start a report or send a Targeted Grab request, it holds the name of that event — and nothing else — for at most two minutes, so that the next page can send it. It is only ever set after you accept.

Google Analytics is told the address of each page without its details — never an email address, a business name or a sign-in link — with a general title for account, report and sign-in pages, and a few events: a report started or finished, a checkout button pressed, a Targeted Grab request, a sign-in. It is never told anything you type, and never a budget, a target or a price. Advertising features and Google signals are switched off.

Changing your mind

You can change your choice at any time with “Cookie settings” at the foot of every page. If you decline after accepting, we stop sending anything to Google Analytics and delete its cookies from your browser.

What we do not set

No advertising cookies and no cross-site tracking cookies.

Managing cookies

You can clear or block cookies in your browser settings; blocking the essential cookies will sign you out and prevent account features from working.