Cookie Policy

Cookies are small files stored on your device that help websites remember you between page loads. ParcelMatch uses a small number of cookies. We list every one of them below, along with which category it belongs to and how long it lasts.

How we handle cookies

On your first visit you'll see a banner with three options: Reject all, Customise, and Accept all. Whichever you choose, strictly necessary cookies are still placed — they are required for the site to function and are exempt from consent under the Privacy and Electronic Communications Regulations (PECR) reg. 6(4). Everything else is opt-in and only set if you explicitly grant the relevant category.

You can change your mind at any time using the Cookie preferences link at the bottom of every page. Your decision is remembered for 12 months and then we ask again. If we add a new category of cookie we'll re-ask straight away.

Strictly necessary cookies

Required for the site to work. We set these no matter what — if you disable them in your browser, sign-in and checkout will break. No consent is required for these under UK / EU rules.

• authjs.session-token (or __Secure-authjs.session-token over HTTPS) — keeps you signed in. HTTP-only, SameSite=Lax, expires after 30 days of inactivity. Set by our authentication library.
• authjs.csrf-token — protects authentication requests against cross-site request forgery. Session cookie (deleted when you close the browser).
• authjs.callback-url — remembers where to send you after sign-in (e.g. back to the order page you were trying to reach). Session cookie.
• pf_checkout — remembers your sender, recipient, and cover details while you complete checkout, so refreshing the page doesn't lose your progress. HTTP-only, expires after 24 hours.
• __stripe_mid and __stripe_sid — placed by our payment processor (Stripe) on the payment step only. Used for fraud prevention; required to process a payment under PCI-DSS. See Stripe's cookie policy for full details.
• parcelfff.cookie-consent — stored in your browser's local storage (not a cookie strictly, but treated the same way for transparency). Remembers which cookie categories you've granted, so we don't keep asking. Expires after 12 months.

Optional cookies

Analytics — currently inactive

When enabled, these would give us aggregate statistics about which pages people visit and how they got there, so we can improve the site. They never identify individuals and never feed into advertising.

We are not currently running analytics cookies of any kind. The toggle in the Customise panel exists so you can pre-set your preference; when we add analytics, your choice will be honoured automatically without us re-asking. When that change happens we will update this page and re-prompt you to confirm.

Cookies we do NOT use

For the avoidance of doubt:

• We do not place advertising or marketing cookies, and we do not allow third-party advertisers to do so on our pages.
• We do not run cross-site tracking pixels.
• We do not share cookie data with social media platforms, ad networks, or data brokers.

Changing or withdrawing your consent

Click Cookie preferences in the footer of any page to re-open the banner and change your settings. You can also clear your choice entirely from your browser's site-data settings — the banner will then reappear on your next visit.

Browser-level cookie controls are also available: most browsers let you block or clear cookies for a single site. Check "Site settings" in Chrome, "Manage Data" in Firefox, or the equivalent setting in Safari or Edge.

Legal basis

Strictly necessary cookies are placed under the exemption in PECR reg. 6(4). All other cookies are placed only with your consent under PECR reg. 6(1) and GDPR Article 6(1)(a). You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Questions

Email hello@parcelmatch.co.uk.

iThis is the public version of the document. Questions? Email hello@parcelmatch.co.uk.