Cookie Policy

Version date: 12 November 2025. This policy applies to taptowrap.co and to every page of the booking flow, whether you are a shopper looking for a slot, a professional wrapper reviewing the network, or a corporate buyer pricing 400 units. It explains the small files we place on your device, what each one does, how long it lasts, and how you turn the optional ones off. Read it alongside our privacy notice, which covers everything else we do with personal data.

What cookies are

A cookie is a short text file that a website asks your browser to store and hand back on the next request. It lets a site remember something between page loads: that you are signed in, that you already entered a postcode, or that this is the fourth page you have viewed rather than the first. Cookies cannot run programs and cannot read other files on your device.

Two distinctions matter. A session cookie disappears when you close the browser; a persistent cookie carries a fixed expiry date. A first party cookie is set by taptowrap.co; a third party cookie is set by another domain whose code we load, such as Google. We also use two adjacent technologies that behave like cookies for legal purposes: local storage, which keeps a value in the browser until it is cleared, and pixels inside emails, which tell us whether a newsletter was opened.

Which cookies we set

The table below is the complete list. Strictly necessary cookies load on arrival because the site cannot work without them. Everything else waits for your consent and is never set if you decline.

Name	Set by	Purpose	Category	Duration
ttw_session	taptowrap.co, first party	Holds your booking basket, the slot you are holding, and the anti forgery token that protects the form	Strictly necessary	Session, cleared on browser close
ttw_postcode	taptowrap.co, first party	Remembers the postcode you tapped so coverage, wrapper list, and slot times stay correct if you leave and come back	Strictly necessary	30 days
ttw_consent	taptowrap.co, first party	Stores your consent choices so we do not ask again on every page	Strictly necessary	6 months
__cf_bm	Cloudflare, third party	Distinguishes people from automated traffic and protects the booking form from scripted abuse	Strictly necessary	30 minutes
_ga	Google Analytics 4, third party	Assigns a random identifier so we can count visitors, see which pages precede a booking, and measure the drop off between tap two and tap three	Analytics	13 months
_ga_<container>	Google Analytics 4, third party	Keeps the session state that Analytics 4 needs to group your page views into one visit	Analytics	13 months
ph_<project>_posthog	PostHog, third party	Product analytics for the four tap flow: which step was abandoned, which wrap tier was compared, whether a slot list was scrolled	Analytics	12 months
_gcl_au	Google Ads, third party	Links a click on one of our adverts to a completed booking so we can tell which campaigns pay for themselves	Advertising	90 days
_gcl_aw	Google Ads, third party	Stores the click identifier from a search advert for conversion attribution	Advertising	90 days

We do not run social media trackers, session recording, heat maps, or data broker pixels, and we do not load an advertising script anywhere in the wrapper onboarding flow.

Consent Mode v2

Google tags on this site run under Consent Mode version 2. In plain terms, the Google scripts load in a blocked state and read two signals from our banner before they do anything.

• analytics_storage controls whether Google Analytics 4 may write the _ga cookies and report your visit.
• ad_storage controls whether Google Ads may write _gcl_au and _gcl_aw and attribute a conversion.
• ad_user_data controls whether we may send data to Google for advertising purposes.
• ad_personalization controls whether you may be added to a remarketing audience.

All four default to denied for every visitor, including visitors outside the UK and the EEA. If you decline, the Google tags still fire a cookieless ping that carries no identifier, only the fact that a page was viewed and the consent state. Google uses those pings to model aggregate campaign totals. No cookie is written, nothing is stored on your device, and the ping cannot be joined to you or to a later visit. If you accept, the tags upgrade to full behaviour on the same page load.

PostHog is gated by the same analytics choice. Our own strictly necessary cookies are unaffected either way, because a booking form without an anti forgery token is not a booking form.

Giving and withdrawing consent

The first time you arrive you see a banner with three options: accept all, reject all, and manage choices. Rejecting is one tap, the same as accepting, and nothing on the page is hidden or slowed if you reject. Under manage choices you can turn analytics on and advertising off, or the reverse.

To change your mind later, select Cookie choices in the site footer. The panel reopens with your current settings, and saving a new choice takes effect immediately: withdrawn categories stop firing on the next page load and the associated cookies are expired. We ask again after six months, or sooner if we add a supplier to the table above. Withdrawing consent never affects a booking you have already made and never changes the price you pay.

Browser and device controls

Your browser gives you a second, independent layer of control. Every major browser lets you view stored cookies, delete them for one site, block third party cookies entirely, or clear everything on exit. The settings live under Privacy and security in Chrome and Edge, under Privacy and security in Firefox, and under Safari then Settings then Privacy on macOS and iOS.

Two things to expect if you block broadly. Clearing cookies erases ttw_consent, so the banner returns. Blocking first party cookies breaks ttw_session, and with it the booking form, because we have nowhere to keep the slot you are holding. If that is your preference, book by phone on +44 20 4525 8810 between 08:00 and 20:00 GMT and we will take the details for you.

Do Not Track and Global Privacy Control

Do Not Track was never given an agreed meaning, and most browsers have removed the setting. We therefore do not treat a Do Not Track header as a consent signal in either direction, which is what the specification’s own authors recommend. We do honour the Global Privacy Control, the successor signal. If your browser or extension sends it, we treat advertising and analytics as declined before the banner is drawn, and California residents can rely on it as a valid opt out of sharing.

Changes to this policy

We audit the cookie table every quarter against what the site actually sets, and we update this page whenever a name, a duration, or a supplier changes. The version date at the top moves with each revision. A new advertising or analytics cookie always resets the consent prompt so you can decide again.

Contact us

Questions about anything on this page go to privacy@taptowrap.co and we answer within five working days. For help with a live booking use support@taptowrap.co or +44 20 4525 8810. Our postal address is TapToWrap Ltd, 2nd Floor, 31 Redchurch Street, London E2 7DJ, United Kingdom, company number 15042118.