Cookie Policy

Introduction

This Cookie Policy explains which cookies AllergyPass uses, what each one does, and how you can control them. It applies to all pages under allergypass.me and works alongside the Privacy Policy, which covers data handling more broadly.

AllergyPass uses a small, fixed set of cookies. There are no advertising cookies, no cross-site tracking pixels, and no cookies sold or shared with third parties for marketing.

What a cookie is

A cookie is a small text file a website stores in your browser. It lets the site remember something between visits, such as a consent choice or an anonymous visit ID. Cookies can be set by AllergyPass directly (first-party) or by a service we use, like an analytics provider (third-party).

Cookies we use

Strictly necessary

These run regardless of consent because the site can't function correctly without them.

• ap_consent_analytics (AllergyPass), stores the cookie choice you make in the consent banner, so you're not asked again on every page. This is kept in your browser's localStorage rather than in a cookie, is never sent to a server, and stays until you clear your browser data.
• ap_checkout_country (AllergyPass), stores the two-letter country code Cloudflare derives from the card-builder request so Canadian visitors can use the full-page secure checkout. It is limited to the card builder, expires after one hour, and is not used for tracking or advertising.

Analytics (subject to your choice)

In the UK, the EU and Switzerland these load only if you allow analytics in the banner. Everywhere else they load unless you decline. See Your consent choices below for exactly what happens where you are.

• _ga, _ga_* (Google Analytics 4), distinguishes unique visitors and sessions to measure how the site and tools are used. Retained up to 13 months.
• _clck, _clsk, CLID, ANONCHK, MR, SM (Microsoft Clarity), powers anonymized session replays and heatmaps so we can see how people actually use the card builder and Risk Checker. Retention varies by cookie, from session-length up to 1 year.

Your consent choices

On your first visit, a banner asks whether you allow analytics. It is served by AllergyPass itself, with no third-party consent provider involved, and "Decline" takes exactly the same single click as "Allow analytics". Your answer is remembered in your browser so you aren't asked again on every page.

Where you are changes what happens before you answer. In the UK, the EU and the wider EEA, and Switzerland, analytics stays switched off until you actively allow it. Everywhere else it starts on and the banner lets you turn it off, which is what those countries' rules ask for. Either way, no advertising or cross-site tracking runs at any point.

You can change your answer at any time: reopen the cookie banner.

Browser controls

Independently of the consent banner, your browser lets you block or delete cookies entirely through its privacy or settings menu. Extensions such as uBlock Origin can also block analytics scripts before they load. The site remains usable with cookies blocked. Without the short-lived checkout country cookie, checkout uses the secure overlay instead of the Canadian full-page route; blocking analytics cookies only removes our visibility into how the visit happened.

Local storage (not a cookie)

The allergy card builder saves your card data using your browser's localStorage, not a cookie. It is never transmitted to a server, isn't covered by the consent banner, and isn't subject to cookie consent rules, since it's not a tracking mechanism. Clearing your browser data removes it. See the Privacy Policy for more detail.

Third-party policies

Each service named above sets and manages its own cookies under its own policy:

• Google Analytics cookie information
• Microsoft Clarity

AllergyPass selects providers with reasonable privacy practices but isn't responsible for how they independently operate.

Policy changes

If the cookies we use change, for example a new analytics tool is added, this page and the consent banner will be updated together, and the "Last Updated" date above will be revised.

Contact

Questions about this policy can be sent through the Contact page.