Cookie policy · iwanttobuymyfreehold.com

The short version

We use no analytics, no advertising and no third-party tracking. There is no Google Analytics here, no advertising pixel, no social media button and no content loaded from anyone else's servers. Everything below exists to sign you in and keep your session secure.

Under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003, storage that is strictly necessary to provide the service you have asked for does not require consent - which covers almost everything in the tables below. Two items go beyond that: remembering a trusted device for two-factor sign-in, and filling in your email address for you next time. Those are what the banner asks about, and until you accept them they are not set at all.

Rejecting them is not a formality. The refusal is enforced by the application itself: with consent outstanding or refused, any cookie not marked strictly necessary is dropped before it reaches your browser, and the stored email address is deleted if it is already there. Nothing on this site stops working either way - you will simply be asked for a two-factor code every time, and type your address in yourself.

Your choice

You have not answered yet on this device, so the optional items are not being set. Silence is treated as a refusal, not as consent.

Your answer is remembered for six months in the bfh.consent cookie described below, after which we will ask again. It is stored per device and per browser, because that is where the storage it governs lives.

1. What a cookie is

A cookie is a small text file a website asks your browser to store and send back on later requests. It is how a site knows that the person loading this page is the same person who signed in a moment ago. "Local storage" does a similar job but is not sent to the server automatically.

2. The cookies we set

Cookies set by iwanttobuymyfreehold.com
Name	Purpose	Expires	Consent
`bfh.auth`	Keeps you signed in. Without it every page would ask for your password again. It is encrypted, marked `HttpOnly` so no script can read it, sent only over HTTPS, and tied to a session record we can revoke.	30 minutes from your last activity - or 14 days if you tick "Keep me signed in"	Strictly necessary
`bfh.csrf`	Protects against cross-site request forgery: it lets us prove that a form submission came from a page we served and not from another site acting in your name.	When you close your browser	Strictly necessary
`Identity.TwoFactorUserId`	Set only while you are part-way through two-factor sign-in, to remember which account is being verified between the password step and the code step.	When you close your browser, or as soon as the sign-in finishes	Strictly necessary
`bfh.msg`	Carries a one-line confirmation across a redirect - "your password has been changed", and the like - so the message survives the page it is about. It holds the message and nothing else, and is deleted as soon as it is shown.	Deleted as soon as the message is displayed	Strictly necessary
`bfh.consent`	Records your answer to the cookie banner, so we do not ask again on every page. It holds one word - `accepted` or `rejected` - and nothing that identifies you.	6 months	Strictly necessary
`Identity.TwoFactorRememberMe`	Set only if you accept optional cookies and tick "remember this device" at two-factor sign-in, so you are not asked for a code on it every time. If you have not accepted, it is never written.	30 days	Optional - only with your consent

3. Local storage

Data stored in your browser rather than sent to us
Name	Purpose	Expires	Consent
`bfh.lastEmail`	Remembers the email address you last signed in with, so the field is filled in next time. Only the address is stored, never your password. It stays in your browser and is never sent to us. Written only if you have accepted optional cookies; rejecting deletes it, and so does clearing the email field before you submit the form.	Until you clear it, or clear your browser's site data	Optional - only with your consent

4. Payment pages and third-party cookies

When you pay a case fee you are taken to a payment page hosted by Stripe at checkout.stripe.com. Stripe sets its own cookies on its own domain, largely to prevent fraud. Those cookies are set by Stripe, not by us; we cannot read them, and they are not set on iwanttobuymyfreehold.com.

Stripe's use of cookies is governed by its own policy, at stripe.com/cookies-policy/legal.

The same applies to our identity checking provider: if you are sent to their page to complete a check, any cookies there are theirs.

5. Controlling cookies

You can delete or block cookies through your browser's settings - every major browser has a privacy section that lets you do this per-site.

If you block bfh.auth or bfh.csrf you will not be able to sign in or submit any form on this site. They are not optional in a technical sense: without them there is no way for us to know who you are or to protect your submissions.

To decline the two optional items, use the buttons above - that is the whole of it, and it applies on this device from the moment you press one. You can also decline them individually by not ticking "remember this device" at two-factor sign-in and by clearing the email field before submitting. Blocking local storage entirely is handled gracefully too; the sign-in page works without it.

6. Changes to this policy

If we add anything that stores data in your browser, we will update these tables before it goes live - and anything that is not strictly necessary will be added to the optional group, which means it is not set until you have said yes.

Questions about this policy go to hello@iwanttobuymyfreehold.com. How we use personal data more generally is covered in our privacy policy.