1. The current cookie inventory
| Name | Purpose | Duration / controls |
|---|---|---|
| dl_session | Essential first-party authentication cookie. An opaque random token; the server stores its hash. | Seven days by default. HTTP-only, SameSite=Lax, path /. Sent only over HTTPS in production. Sign-out removes it. |
| dl_admin_challenge | Essential administrator password-verification challenge, before second-factor verification. | Five minutes. HTTP-only, SameSite=Strict, path /api/admin. Sent only over HTTPS in production. |
| dl_admin_session | Essential administrator session after password and second-factor verification. | Twenty minutes of inactivity, renewed by user interaction. Locks after ten idle minutes; password re-entry is required. Three failed unlock attempts revoke the session. HTTP-only, SameSite=Strict, path /api/admin. Sent only over HTTPS in production. |
2. Your choices
dropLog uses privacy-friendly analytics cookies (PostHog) to understand how the platform is used. We do not set advertising cookies. A cookie notice appears on your first visit with an Understood button and a link to this policy. You can browse public pages without signing in and reopen the notice using Cookie settings on any page.
You can remove or block cookies through your browser’s site-data settings. Blocking essential authentication cookies prevents sign-in from working. Public pages remain available. Animations follow your device’s reduced-motion preference; dropLog does not store a separate animation preference.
Essential authentication and security storage supports the service you request. Where it contains personal data, the purposes, applicable lawful bases and your UK GDPR rights are explained in our privacy notice and data-rights page. Cookie consent and a lawful basis for processing personal data are separate requirements.
3. Browser preferences
The website stores your cookie-notice acknowledgement when you select Understood. It expires after 180 days; the notice appears again after expiry or when site data is cleared. The administrator workspace also stores the layout and refresh preferences below when you choose them; those preferences have no automatic expiry. They contain interface settings, not passwords, customer records or driver locations, and are not used for advertising or profiling.
| Name | Purpose | How to remove |
|---|---|---|
| droplog-cookie-notice-v1 | Remembers that you acknowledged the essential-cookie notice. Stores an expiry timestamp, not a tracking identifier or permission for optional cookies. | Expires after 180 days. Clear local storage for droplog.co.uk to remove it earlier. Cookie settings reopens the notice at any time. |
| dl-admin-sidebar-hidden | Remembers your selected administrator sidebar layout. | Change the sidebar setting or clear local storage for droplog.co.uk in your browser. |
| dl-admin-dashboard-refresh | Remembers the dashboard refresh interval you choose, including Off. | Change the refresh setting or clear local storage for droplog.co.uk in your browser. |
4. If optional services are added
Any future non-exempt storage or access technology must remain disabled until the required consent is obtained. Where consent is needed, provide an equally accessible refusal option, purpose-specific choices and an easy way to withdraw. Assess the rules in each launch country; UK exemptions should not be assumed to apply throughout the EU.
Map tile requests are described in the privacy notice. A network request is not automatically a cookie, and a cookie choice does not replace the assessment of personal information disclosed to the map provider.
5. Our service and contacting us
dropLog is hosted on a Scaleway server behind our HTTPS reverse proxy. Product analytics are processed by PostHog (US Cloud) and Firebase Analytics. No advertising network or advertising cookie is present; the ad slot on the tracking page is a server-side image with no browser storage. We review this inventory when storage or third-party services change. Browser extensions and local developer tools may create their own storage; they are not part of dropLog’s production application.
The operator is UNLIMIT DIGITAL LTD, company number 16439193. You can write to 31–33 Worcester Street, Gloucester, England, GL1 3AJ with a privacy enquiry. Our privacy notice and GDPR page explain access, correction, deletion and complaint routes.
Official guidance & references
The sources below inform the review. They do not certify this product or replace the company’s operational responsibilities.
ICO: storage and access technologiesEU General Data Protection Regulation