Cookie notice
What we store in your browser, and why there is no banner.
In effect from 1 October 2026.
There is no cookie banner on smplr, and that is not an oversight.
UK law requires consent for cookies that are not strictly necessary — the ones that follow you around, measure you, or advertise to you. We do not set any. Everything we store in your browser is either required to sign you in, or stored because you operated a control that asks for it. That needs telling you about, which is what this page is, but it does not need a banner.
What we store
| Name | What it is | How long | Why |
|---|---|---|---|
_simple_key |
A signed session cookie | Until you close your browser | Keeps you signed in as you move between pages, and protects forms against cross-site request forgery. Without it you could not sign in at all. |
_simple_web_user_remember_me |
A signed sign-in token | 14 days on the website, 90 days in the phone app | On the website, set only if you tick "Keep me signed in on this device" when you sign in. In the smplr phone app it is always set, because the app keeps you signed in on that phone, and it lasts as long as the phone's sign-in. Signing out deletes it, and so does signing in again on the website with the box left unticked. |
_smplr_clock |
A signed token for a shared clock screen | 400 days | Set only on a tablet or computer that a manager has paired as a workplace's clock screen. It tells us which clock screen the device is, so people can clock in on it with their PIN. It is not linked to any person. Removing the clock screen in smplr stops it working. |
phx:theme |
A light/dark preference | Until you clear it | Stored in your browser's local storage, not a cookie, and only once you have used the theme toggle. It never reaches our servers. |
The clock screen's cookie is set with SameSite=Strict and the others with
SameSite=Lax, and in production all of them only over HTTPS. They are
signed, so they cannot be tampered with, and they contain no personal data
beyond an opaque reference.
What we do not do
No analytics. No advertising or remarketing. No session recording. No social media pixels. No third-party chat widget. Nothing that builds a profile of you across sites.
Our pages load nothing from anyone else at all — the typefaces they use are served from our own servers rather than a font network, so visiting a page tells no third party your IP address. The sub-processors page lists every supplier we use, with their role and location.
Turning them off
Your browser can block or delete cookies. If you block ours, signing in will not work — the session cookie is what keeps you signed in — but nothing else about smplr depends on them.
Questions
Write to trust@smplr.co.uk. Our privacy policy explains what we do with personal data more generally.