Legal

Cookies Policy

Last updated 23 September 2026

What this policy covers

A cookie is a small file a website asks your browser to keep. Browsers also offer local storage and session storage, which work differently but do the same job: they leave data on your device. UK law treats all of it the same way, and so does this policy — everything listed below is covered, whether or not it is strictly a cookie.

This policy applies to whichrenewables.com. It sits alongside our Privacy Policy, which explains more broadly how we handle personal data and what rights you have over it.

What we store

This list is generated from the same settings the banner controls, so what you read here is what the site actually sets.

Strictly necessary

Always on

Needed for the site to work: signing in, keeping you signed in, security, and remembering this cookie choice. They cannot be switched off.

What it is	Purpose	Kept for
wr_cookie_consentCookie · Which Renewables	Remembers your cookie choices so we stop asking.	6 months
authToken, whichrenewables_userLocal storage · Which Renewables	Keeps you signed in to your account and your dashboard.	Until you sign out (7 days maximum)
adminTheme, lastAddonPurchaseLocal storage · Which Renewables	Remembers preferences you set and keeps a purchase in progress from being lost if a page reloads.	Until you clear your browser data
Service worker cacheCache storage · Which Renewables	Stores pages and images already downloaded so the site loads faster on your next visit.	Until you clear your browser data
sessionid, csrftokenCookie · Which Renewables	Staff administration area only. Maintains the session and blocks cross-site request forgery.	Session

Analytics

Your choice

Helps us see which pages and listings people use, so we can improve them, and lets us recognise your browser when you come back so a returning visitor is counted once rather than once a day. Switching this off does not stop a member company seeing that their listing was viewed — those counts are then measured on our server without storing anything on your device.

What it is	Purpose	Kept for
ph_*_posthogCookie and local storage · PostHog (self-hosted by Which Renewables)	Groups the pages of one visit together so we can see how the site is used. Behavioural only; it is never shown to member companies.	12 months
_ga, _ga_*Cookie · Google Analytics 4	Tells us how people find the site -- which search terms and links brought them here, and which pages they then used. Used only to improve how we are found; advertising and cross-device tracking features are switched off, and it is never shown to member companies.	13 months
analytics_anon_idCookie · Which Renewables	A random identifier, so repeat visits from this browser count as one visitor in the statistics member companies see about their listings. If you sign in it is linked to your account, so your visits count once across your devices; signing out replaces it. Never shared, never used for advertising.	12 months
wrAnalyticsSessionSession storage · Which Renewables	Links the pages of a single visit, so a listing view and a later enquiry can be counted as one journey rather than two strangers.	Until you close the tab

Payments

If you subscribe, the payment is handled by Stripe. Stripe’s script loads only on the pages where you actually pay, and it sets its own cookies to tell a genuine payment from a fraudulent one. These are necessary for the payment to work: without them we cannot take one safely, so they are not part of the analytics choice above.

What it is	Purpose	Kept for
__stripe_midCookie · Stripe	Fraud prevention — recognises the device between payments.	1 year
__stripe_sidCookie · Stripe	Fraud prevention — identifies the current payment session.	30 minutes

Stripe is a separate data controller for what it collects; its own privacy notice is at stripe.com/gb/privacy.

What we do not use

This site carries no advertising and no cross-site tracking. Specifically, we do not use:

advertising, retargeting or audience-building cookies of any kind;
Google Analytics, Google Ads or DoubleClick;
the Meta (Facebook) pixel, the LinkedIn Insight Tag, or any other social advertising tag;
session-replay tools that record your mouse movements, scrolling or keystrokes;
device fingerprinting;
any sale or sharing of your data for advertising.

Our pages load typefaces from Google Fonts. That sets no cookies, but it does mean Google receives your IP address as part of the request for the font file.

If any of this changes, this page changes with it and the banner asks again rather than carrying your old answer over.

How listing statistics work if you accept

If you accept analytics cookies, our server also sets one cookie of its own, analytics_anon_id. It holds a random identifier — it is not worked out from your IP address, your browser or anything else about you — so that when you come back, your visits are counted as one visitor rather than as a new visitor every day. Our server keeps only a one-way hash of it, and the page cannot read it.

If you sign up or sign in, the identifier is linked to your account, together with the visits you made before signing in, so you are counted once across your devices. Signing out ends that link: the browser is given a new identifier, so whoever uses it next is not counted as you. Member companies only ever see totals — how many people, never who.

Withdrawing consent deletes the cookie, and it is not set again unless you say yes.

How listing statistics work if you refuse

Member companies can see how their own listing performed: how many people viewed it, revealed their contact details, or sent an enquiry. Those counts include visits from people who refused analytics cookies, because they are measured on our server and nothing is stored on your device to do it.

To avoid counting the same person twice without recognising who they are, our server derives a one-way hash from your IP address, your browser’s user-agent string, a secret key and today’s date. The raw IP address is never stored, and because the date is part of the hash the result changes every day — it cannot be used to follow you from one day to the next, or to identify you at all.

We rely on legitimate interests for this measurement under UK GDPR: it is the reporting a member company subscribes for, and it tells them how many people looked, never who. If you refuse analytics cookies nothing is kept on your device to connect one visit with another: the pages you open are grouped only until you reload or close the page, and the more detailed journey reporting stops there.

Controlling cookies in your browser

Your browser can also delete or block cookies for any site, independently of the choice you make here:

Chrome: Settings → Privacy and security → Third-party cookies
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Settings → Privacy → Manage Website Data
Edge: Settings → Cookies and site permissions → Manage and delete cookies

Blocking everything, including the strictly necessary items, will stop you signing in — the site has no other way to remember that you are logged in.

Changes, and how to reach us

We update this policy when what we store changes. The date at the top of the page says when it was last revised, and a new or changed category re-opens the banner so you can answer for it.

Questions about this policy, or about anything we hold on you, can go to admin@whichrenewables.com. Registered Office: 1-7 Park Road, Caterham, London, England, CR3 5TB.

If you are not satisfied with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk.