Cookies and tracking
You’ve never seen a cookie banner on Bowerstead. That isn’t an oversight, it’s the point: we only set the three cookies the site actually needs to work, and the two measurements we take set no cookie and store nothing at all on your device. This page is the full accounting, including what those measurements see.
What we set
A sign-in cookie. When you sign in, our authentication provider (Supabase) sets a cookie that keeps you signed in and gets refreshed as you move around. Without it you’d be signed out on every page. It’s read by us and nobody else, and it disappears when you sign out.
A currency cookie, named bw_currency. So that a visitor in London sees pounds rather than dollars, we look at the country our host reports for your connection, once, and store the resulting currency code for 30 days. That is the whole contents: three letters, like gbp. It holds no identifier and no history, we never send it anywhere, and the setting at the bottom of our homepage overwrites it whenever you disagree with the guess. It is also what decides the currency you are charged in, which is why it is a cookie and not a guess made fresh on every page.
A country cookie, named bw_country. Written at the same moment, holding the two-letter country code from that same lookup, like GB. It exists for one reason: so the footer can tell you which country your prices were chosen for, instead of leaving you to guess why you are seeing euros. Nothing else reads it, and it has no say in what you are charged.
That’s the list. Three cookies, all doing a job you can see on the page.
What we don’t set
- No analytics cookie and no analytics account. We do count page views, and the next section says exactly what that sees. What we don’t do is Google Analytics, an advertising network, or anything that builds up a picture of you over time.
- No advertising pixels. No Meta pixel, no Google Ads tag, no conversion tracking. We don’t retarget you.
- No third-party cookies, and nothing following you to other websites.
- No session recording, and no tool that plays back what you did on screen or reads what you typed.
- Nothing that reads your homeschool. No measurement we take can see a child’s name, a note you wrote, a grade, or a photo. That isn’t a policy we keep to, it’s a thing the code makes impossible, and it’s the rule the whole product is built around.
This is why there’s no banner. The rules that require a consent popup are about tracking and advertising storage. A cookie that only keeps you signed in is one you’ve effectively asked for by signing in, and the two that show a price in your own money and name the country it was chosen for are the kind of preference those rules set aside as necessary to the thing you came here to do. None of them identifies you or follows you anywhere, so interrupting you to demand permission for them would be theatre. The measurements below sit outside those rules for a plainer reason: they put nothing on your device and read nothing from it, so there is nothing stored to ask you about.
Things kept on your own device
Not everything stored in a browser is a cookie, and it’d be a dodge to only talk about cookies. Bowerstead also keeps a little data locally on your device, which never gets sent anywhere on its own:
- Your offline captures. If you note something with no signal, it waits in a queue on your device and syncs to your account when you’re back online.
- Small bits of interface state, so a screen opens the way you left it.
- Your session, in the phone app. On iPhone and on Android alike, the app keeps you signed in with device storage rather than a cookie. Same job, different mechanism.
Bowerstead installs as an app, and that needs a service worker. Ours is deliberately thin: it exists so the install works, and it passes every request straight to the network without caching or reading anything.
What we measure
Two measurements run on bowerstead.com, both from Vercel, who host the site. Neither sets a cookie, neither stores anything on your device, and neither can reach your homeschool content.
Vercel Speed Insights, so we know whether pages load and respond quickly. It sends the page address and timings such as loading, layout shift, and interaction speed.
Vercel Web Analytics, so we know which pages people find useful and how they got here. With each page view it records the page address, the site that linked you, the country, region, and city your connection appears to come from, and your browser, operating system, and device type. It also counts three named moments: that an account finished setting up, that someone opened the payment page, and that a report finished. Those three are counts and nothing more. Which kind of report was made, never whose, and never a word of what was in it.
Addresses are cleaned before they leave your browser. A page address inside your account can carry the identifier of one of your children’s records, so we replace it: a child’s records page is measured as /records/[id] and never as the real address. From the rest of the address we keep a short, fixed list and nothing else. That list is the campaign labels naming which link or advert brought you here, and one word saying whether a payment page was finished or turned away from. Everything else is dropped without being looked at, including anything you typed into a form. Sign-in links carry a live token, so they are not measured at all.
To recognise a repeat visit without a cookie, Vercel identifies a visit by a hash of the incoming request rather than by anything kept on your device, and discards it after 24 hours. Vercel states that the result is not tied to an individual or to an IP address and cannot be used to follow you to another website. The public landing and the app both serve their typefaces from Bowerstead itself; loading a page does not contact a font provider.
Clearing them
Signing out clears your session. Beyond that, every browser lets you delete cookies and site data, and you can block cookies for bowerstead.com entirely. Fair warning: block the sign-in cookie and you won’t be able to stay signed in, since that’s the one doing the work.
What changed, and when
Web Analytics went live on 31 August 2026, and this page was rewritten the same day. Until then this page said we’d ask you before adding anything that watches what you do. We didn’t ask, and you deserve the reasoning rather than a quiet edit: what we added counts pages and not people, it stores nothing on your device, and a consent box for it would have been the interruption without the protection. If you think that’s the wrong call, say so and we’ll listen.
The promise that stands is narrower and harder. Anything that could identify you, follow you to another website, or read a word you have written about your children gets asked about first, not announced afterwards. The privacy policy has the wider picture of what we store and who touches it.
Contact
Questions about any of this? Email contact@bowerstead.com.