Cookie policy

Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit websites. They are widely used to make websites work more efficiently, provide a better user experience, and give website owners information about how their site is being used.

Cookies cannot access other information on your device, and they cannot be used to identify you personally unless combined with other information we hold about you.

This Cookie Policy explains how Herd UK Ltd (“we”, “us”, or “our”) uses cookies and similar technologies on our website herduk.co.uk and related services.

We use cookies for three purposes, and only these three:

• Authentication: To recognise you when you sign in, to keep you signed in as you move between pages, and to renew your session when the short-lived sign-in token expires
• Connection flows: To complete a connection to a social account, a storage account or a mailbox safely, by checking that the reply coming back from that provider is the one we sent you to and has not been tampered with
• Analytics, only if you accept: To understand how people find and use Herd, through Google Analytics (clause 6), and to remember whether you accepted or rejected it

We do not use cookies for advertising. We set no advertising cookies, and there is no advertising script on our website or in the product.

Cookies can be classified in several ways:

By Duration

• Session Cookies: Temporary cookies that are deleted when you close your browser. Used for things like keeping you logged in during your session.
• Persistent Cookies: Remain on your device for a set period or until you delete them. Used for remembering preferences and analytics.

By Origin

• First-Party Cookies: Set by us directly when you visit our website.
• Third-Party Cookies: Set by another company, on that company’s own domain, when part of its service is used inside ours. The only example on Herd is Stripe’s hosted checkout (clause 8).

Every cookie listed in clauses 4 and 6 is a first-party cookie, set on herduk.co.uk. The sign-in and connection cookies are httpOnly, which means the page’s scripts cannot read them. The consent cookie and the Google Analytics cookies are read by the page, because that is how your choice is applied. All of them are marked Secure in production so they are only ever sent over an encrypted connection.

These cookies are necessary for the Service to function and cannot be disabled. They are the only cookies we set without asking you. Signing in sets the first two; the connection cookies are set only at the moment you start connecting an account, and are cleared as soon as that connection finishes; the last one records your answer to the cookie banner.

Signing out clears the session cookies. The connection cookies expire by themselves, and the one used to complete a connection is cleared as soon as it has been checked.

Legal basis: These cookies are strictly necessary to provide the Service and do not require your consent under PECR (Privacy and Electronic Communications Regulations).

We set no functional cookies. The few things the product remembers about how you are using it — which tips you have dismissed, how far through onboarding you are — are kept in your browser’s own local storage, which is never sent to us. Clause 10 lists them.

Legal basis: Not applicable while no functional cookies are set. If we introduce one, this clause will say what it is for and how long it lasts.

We use Google Analytics 4 to see how people find Herd and which parts of it they use, so we can improve it. It runs only if you choose Accept analytics on the cookie banner. Until you do, and at any time after you reject it, nothing from Google is loaded: no script, no cookie and no measurement request.

With your consent, Google Analytics receives the pages you view (with account ids and share-link codes removed from the address), the site that referred you, campaign tags in the link you followed, your device and browser type, and your approximate location, which Google derives from your IP address and does not store. It also receives a small number of actions: signing up, signing in, starting a plan checkout, completing a subscription or purchase, booking a demo, connecting a social account, and scheduling or publishing a post. We never send your name, email address or the content of your posts.

Google processes this data on our behalf. We have not enabled Google’s advertising features or Google Signals, and the data is not used to show you ads.

To withdraw your consent, choose Cookie settings at the bottom of any page on our website and select Reject analytics. We stop sending data straight away and delete the Google Analytics cookies from your browser.

Legal basis: Your consent, under PECR and Article 6(1)(a) UK GDPR.

We set no marketing or advertising cookies. We do not run advertising campaigns that track you, and there is no Meta, Google Ads or TikTok conversion tag on the site.

If that changes, we will update this policy to name the cookies and obtain your consent before enabling them.

Legal basis: Not applicable while no marketing cookies are set. Explicit consent would be required before any were.

We do not let third parties set cookies on herduk.co.uk. What follows are cookies another company sets on its own domain, when you are taken to its page or when its content is embedded in ours. We do not control them and we cannot read them.

Payment Processing (Stripe)

Paying for a subscription, or paying an invoice through Herd, takes you to Stripe’s own hosted checkout page. Stripe sets its own cookies there, on Stripe’s domain, for fraud prevention and to keep the payment secure. Those cookies are Stripe’s, not ours. See Stripe’s Cookie Policy.

Social Media Embeds

If you view embedded content (like TikTok videos), those platforms may set their own cookies. These are subject to the respective platform’s cookie policies:

• TikTok Cookie Policy
• Meta/Instagram Cookie Policy
• X (Twitter) Cookie Policy

Customer Support

We do not currently use a live chat or support widget, so none is setting cookies. If we add one, we will name it here.

9.1 Current Preference Controls

The first time you visit, a banner asks whether you accept analytics cookies, with Accept analytics and Reject analytics given equal weight. You can change your answer at any time from Cookie settings at the bottom of any page on our website. The essential cookies in clause 4 are not covered by this choice, because the Service cannot work without them. You can also manage cookies through your browser, as described below.

9.2 Browser Settings

Most browsers allow you to control cookies through their settings. Here’s how to manage cookies in popular browsers:

• Chrome: Settings → Privacy and security → Cookies and other site data (More info)
• Firefox: Settings → Privacy & Security → Cookies and Site Data (More info)
• Safari: Preferences → Privacy → Manage Website Data (More info)
• Edge: Settings → Cookies and site permissions → Manage and delete cookies (More info)

9.3 Opt-Out Tools

On Herd, the cookie banner is all you need: rejecting analytics stops Google Analytics entirely. These tools are listed because they are useful across the rest of the web:

• Google Analytics Opt-Out Browser Add-on
• Network Advertising Initiative Opt-Out
• Digital Advertising Alliance Opt-Out

9.4 Impact of Disabling Cookies

If you block or delete cookies, please note:

• You will not be able to sign in, and deleting the session cookies while signed in will sign you out
• Connecting a social account, Google Drive or a mailbox will fail, because the check that makes the connection safe depends on the cookie set at the start of it
• The Service cannot be provided without these cookies, so they are not something we can offer to switch off
• Blocking local storage as well will not stop you using Herd, but tips you have already dismissed may reappear

Alongside cookies, the product keeps a small amount of information in your browser’s own storage. Unlike a cookie, this is never sent to our servers: it stays on the device, and clearing your browsing data removes it.

Local Storage

Local storage keeps the item until you clear it. We use it only to avoid repeating things at you:

Session Storage

Session storage is cleared when you close the tab. We use two items, password_reset_in_progress and password_reset_timestamp, which exist only while you are part-way through resetting your password, so that the reset screen behaves correctly if the page reloads. If you accepted analytics, items beginning herd_ga: note which one-off actions (such as a completed checkout) have already been counted, so reloading the page does not count them twice.

Pixels and Beacons

Apart from the measurement requests Google Analytics sends when you have accepted it (clause 6), we do not use tracking pixels or web beacons on our website or in the product. If we introduce open- or click-tracking in marketing email, we will update this policy and ask for your consent first.

We may update this Cookie Policy from time to time to reflect:

• Changes in the cookies we use
• Changes in legal requirements
• Changes to our practices

We will update the “Last updated” date at the top of this policy. For significant changes, we will request consent through any preference controls we implement for non-essential cookies.

If you have questions about our use of cookies, please contact us:

For more information about how we handle your personal data, please see our Privacy Policy.