Cookie Policy

1. What are cookies?

Cookies are small text files stored on your device when you visit a website. They help the website remember your preferences and understand how you use the site.

2. How we use cookies

TrainedTeam uses a minimal number of cookies and similar technologies, focused on essential functionality. Where we use anything beyond strictly necessary cookies, we ask for your consent first through a banner on your first visit. You can change your choice at any time via the “Cookie preferences” link in the footer of every page.

Essential cookies (strictly necessary)

These cookies are required for the Service to function and cannot be switched off. They include:

Functional cookies

These cookies remember your preferences to enhance your experience:

Analytics

We use Vercel Analytics and Vercel Speed Insights to understand site traffic and page performance. These tools are cookieless by design but they process your IP address at request time. Because UK GDPR treats this as personal data, we only load them after you have opted in via the cookie banner.

We also use Google Analytics 4 (GA4) to understand how visitors find and use our marketing pages. Unlike Vercel Analytics, GA4 sets cookies in your browser. The two cookies it sets are _ga (used to distinguish unique visitors, persistent for 2 years) and _ga_PYNRW88Y7C (used to maintain session state, persistent for 2 years). GA4 is only loaded after you opt in via the cookie banner. If you reject or never accept, no GA4 requests are made, no cookies are set, and no data is collected.

We use PostHog for product analytics, session replay, and error tracking, so we can see which parts of the site are used and where the instruction creator breaks. Like the above, PostHog is only started after you opt in via the cookie banner: if you reject, or never answer it, PostHog is never initialised, no request is made to it, and nothing is stored on your device. Once you accept, it sets one cookie, ph_phc_…_posthog, holding a randomly generated device identifier for 12 months, and mirrors it in localStorage. If you later change your choice to reject, PostHog stops capturing and clears what it had stored.

Session replay. With analytics accepted, PostHog records your interactions with our pages - clicks, scrolling, navigation, and the content of the pages as rendered - so we can replay a visit that went wrong. Anything you type into the instruction creator, and any image you upload to it, is redacted in your browser before the recording is sent, as are the contents of all form fields. We use replays to fix the product, never to build a profile of you, and you can opt out at any time via the Cookie preferences link.

Where your data goes. Our PostHog projects are hosted in the EU (Germany). PostHog is listed on our sub-processors page.

In the app. The application at app.trainedteam.com asks for its own choice, because it is a separate site. If you allow analytics there, it uses PostHog (the same cookie as above, with session replay) and Vercel Web Analytics. App recordings hide every word on the screen, everything you type and every image, because the app shows your organisation's procedures, names and training results. If you refuse, neither loads. You can change your choice at any time in Settings, Account, Analytics.

We do not use Meta Pixel, TikTok Pixel, or any advertising or fingerprinting service.

Marketing

We do not use any marketing or advertising cookies, pixels, or trackers. If that ever changes we will update this policy and ask for fresh consent.

3. Third-party cookies

The TrainedTeam marketing website (trainedteam.com) does not set third-party cookies. The analytics cookie described in section 2 is set by PostHog's script on our own domain, which makes it a first-party cookie, and it is only set once you have opted in. The application (app.trainedteam.com) uses authentication cookies from our infrastructure provider for secure sign-in and, only if you allow analytics there, the PostHog cookie described in section 2.

If you sign in with Google or Microsoft SSO, those providers may set their own cookies during the authentication flow. Please refer to their respective privacy policies for details.

4. localStorage and sessionStorage

In addition to traditional cookies, we use browser storage (localStorage and sessionStorage) for client-side preferences. These remain on your device and are not sent to our servers. The one exception is the analytics storage PostHog uses once you opt in, described in section 2, which is sent to PostHog. You can clear browser storage through your browser settings.

5. Managing your choice

The first time you visit the site, a cookie banner asks whether you want to accept all categories, reject all, or manage them individually. Strictly necessary cookies are always on; analytics is opt-in.

You can change your choice at any time using the Cookie preferences link in the footer. We store your choice in your browser's local storage, not in a cookie, and we re-ask after 12 months.

You can also control cookies through your browser settings. Most browsers let you view stored cookies, delete them, and block them per site. Note that blocking essential cookies will prevent you from signing in to TrainedTeam.

6. UK PECR and UK GDPR compliance

Under the Privacy and Electronic Communications Regulations (PECR) Regulation 6(4), strictly necessary cookies are exempt from consent. We rely on that exemption only for authentication, security (CSRF), and the consent record itself.

For anything else - including analytics from Vercel (which is cookieless but still processes IP addresses), Google Analytics 4 (which sets cookies), and PostHog (which sets a cookie and records sessions) - we ask for opt-in consent under UK GDPR, with the option to reject made as easy as the option to accept (per ICO guidance). We do not pre-tick any consent boxes, and none of these are loaded before you have chosen.

Separately from the above, when a request to our server fails we record the error, the route that failed, and the technical stack trace so we can fix it. That record sets no cookie, reads nothing from your device, and is not linked to you or to any profile, so it does not require consent; we rely on our legitimate interest in keeping the Service working.

7. Changes to this policy

We may update this policy if we change our use of cookies. Material changes will be communicated through the application or by email.

8. Contact

For questions about our use of cookies, contact us at privacy@trainedteam.com.