DOC LGL-15 — LEGAL / STUDIO

Cookie Notice

Last updated 2026-08-20

This notice is the declaration of everything our websites, tacitlabs.co.uk and refundmyrail.co.uk, store in your browser: every cookie and every other kind of browser storage, by name, grouped under the consent banner's four categories. A cookie is a small piece of text a website stores in your browser so that something can be remembered between pages or between visits; browsers offer other kinds of storage that the rules treat the same way, and this notice covers those too. Before you answer the banner, our site sets no cookies at all; the optional categories load only if you accept them, and ignoring the banner is the same as refusing. What the data is used for, who is responsible for it, what withdrawing your consent clears, international transfers and retention are all set out in our Privacy Policy. This page is the inventory.

1. Your choice

1.1 You can review or change your cookie choice at any time, one category at a time, from this page or from the banner. Refusing a category takes effect immediately, clears from your device everything that category stored under this site's own address, and reloads the page. Two entries below are set by Google and by TikTok under their own addresses instead. A website cannot delete another company's cookie, so those two are left to expire on the schedules shown against them. Refusing still stops either being set again. "Changing your mind" in our Privacy Policy describes exactly what withdrawing does and does not undo.

1.2 The banner is operated for us by Cookiebot, a product of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, acting as our processor. Answering it either way stores the CookieConsent cookie listed under Necessary below, so that every later page respects your answer, and logs the answer with Cookiebot as the evidence that you were asked; what that record holds is set out in the Privacy Policy's processor table.

2. The banner's four groupings

2.1 The banner says Marketing where our documents sometimes say advertising; they are the same category.

On the banner	What is behind it	Listed in
Necessary, always on	Remembering your answer to the banner itself; the Turnstile security check on pages with a sign-up form; and three working items of our own	Section 3
Preferences	The colour tint you can pick for these pages, stored only at the moment you pick it	Section 4
Statistics	PostHog, one product-analytics tool that measures how this site is used and reports to nobody else	Section 5
Marketing	Five advertising tags: the Meta Pixel, the Google tag, the Reddit Pixel and the TikTok Pixel, plus one working item of our own	Section 6

3. Necessary

3.1 Set without consent, because each is needed for something you asked for: a refusal that is remembered rather than re-asked, a sign-up form protected from abuse, an introduction that does not replay, a page that does not refetch its public data, and a notice you have already read that does not reopen itself. None identifies you to anyone. The Turnstile check itself is described under "Bot protection on our forms" in our Privacy Policy.

Name	Provider	Purpose	Maximum storage duration	Type
`CookieConsent`	Cookiebot	Which categories you accepted and which you refused, with a random reference	12 months	HTTP Cookie
`cf.turnstile.u`	Cloudflare	State for the check that you are a person, on pages with a sign-up form	Persistent	HTML Local Storage
`tl-intro`	Tacit Labs	Records that the homepage introduction has already played in this tab, so it does not replay as you move around the site	Session	HTML Session Storage
`hs_cache_*`	Tacit Labs	On the Horizon Suite page only, a copy of the public data that page displays, so it does not fetch it again every time you open the page. One entry per source, refreshed on your next visit once it is more than a few minutes old	Persistent	HTML Local Storage
`rmr.network.seen`	Tacit Labs	On refundmyrail.co.uk only, records that you have seen the current service-report notice, so it stays collapsed instead of reopening on every page	Persistent	HTML Local Storage

3.2 "Session" means it is gone when you close the tab; "Persistent" means it stays until you clear this site's data.

4. Preferences

4.1 One entry, written only when you use the tint control; if you never use it, nothing is stored. Storage made at your request in this way does not require prior permission, which is why it does not wait for the banner's Preferences switch. Undo it by picking the other tint, or by clearing this site's data.

Name	Provider	Purpose	Maximum storage duration	Type
`tl-sheet-tint`	Tacit Labs	The paper or blueprint tint you picked, so the site looks the way you left it	Persistent	HTML Local Storage

5. Statistics

5.1 Loads only if you accept Statistics: PostHog, operated by PostHog Inc. as our processor. Eight entries in all, two cookies and six items that are not cookies. None of them holds anything you typed into a form. [token] below stands for our project's public identifier. What PostHog receives, the masked session replay, the browser profile and how long everything is kept are set out under "Product analytics in detail: PostHog" in our Privacy Policy.

Name	Provider	Purpose	Maximum storage duration	Type
`ph_[token]_posthog`	PostHog	Identifies your browser, so one visit holds together and a return is recognised as the same browser	1 year	HTTP Cookie
`ph_[token]_posthog`	PostHog	A second copy of the same identifier, in case the cookie is lost	Persistent	HTML Local Storage
`__ph_opt_in_out_[token]`	PostHog	PostHog's record that you permitted it to record anything at all	Persistent	HTML Local Storage
`ph_[token]_posthog`	PostHog	The identifier, for the visit in progress	Session	HTML Session Storage
`ph_[token]_primary_window_exists`	PostHog	Whether the tab you are in is the active one	Session	HTML Session Storage
`ph_[token]_session_registered_properties`	PostHog	What is known about the visit you are in the middle of	Session	HTML Session Storage
`ph_[token]_window_id`	PostHog	Which window the visit is running in	Session	HTML Session Storage
`dmn_chk_[id]`	PostHog	A one-off check that PostHog is able to write a cookie on this address at all	Session	HTTP Cookie

6. Marketing

6.1 Load only if you accept Marketing: five advertising tags. Each loads a script from its provider and sets first-party cookies in your browser.

Provider	What it is for	Longest anything is kept
Meta Pixel, operated for us under Meta's Business Tools Terms	Identifies your browser so that Meta can attribute a visit or a sign-up to our marketing, and measure how a campaign performs	90 days
The Google tag, operated by Google Ireland Limited, covering both Google Analytics 4 and Google Ads	Distinguishes browsers so that we can measure site traffic and which channel or advertisement it arrived from, and attributes a conversion such as a sign-up to a Google ad click	2 years
Reddit Pixel, operated by Reddit, Inc.	Identifies your browser so that Reddit can attribute a visit or a sign-up to our marketing	90 days
TikTok Pixel, operated by TikTok Information Technologies UK Limited	Identifies your browser and the advertisement you arrived from so that TikTok can attribute a visit or a sign-up to our marketing, and groups the pages you viewed into a single visit	13 months

6.2 Everything this category stores, by name. All of it belongs to the four tags except the last row, which is ours:

Name	Provider	Purpose	Maximum storage duration	Type
`_fbp`	Meta	Identifies your browser to Meta	90 days	HTTP Cookie
`_fbc`	Meta	Holds the reference from a Meta ad you clicked; set only if you arrived from one	90 days	HTTP Cookie
`_ga`	Google Analytics	Distinguishes your browser from others	2 years	HTTP Cookie
`_ga_*`	Google Analytics	Keeps the state of your current visit	2 years	HTTP Cookie
`_gcl_au`	Google Ads	Holds the reference from a Google ad you clicked	90 days	HTTP Cookie
`_rdt_uuid`	Reddit	Identifies your browser to Reddit	90 days	HTTP Cookie
`_rdt_em`	Reddit	A slot Reddit's pixel keeps for a scrambled email address. We never give it one, so it holds nothing we supplied; the pixel writes it on every page regardless	90 days	HTTP Cookie
`_rdt_pn`	Reddit	The same slot for a telephone number, and the same answer: we never give Reddit one	90 days	HTTP Cookie
`test_cookie`	Google (doubleclick.net)	Written and read back once to check that your browser accepts cookies at all	1 day	HTTP Cookie
`_ttp`	TikTok	Identifies your browser to TikTok. Set twice: once on this site's address, which withdrawal removes, and once on TikTok's own, which only TikTok can remove	13 months	HTTP Cookie
`_ttclid`	TikTok	Holds the reference from a TikTok ad you clicked	30 days	HTTP Cookie
`_tt_enable_cookie`	TikTok	Records that the TikTok pixel may set cookies	13 months	HTTP Cookie
`ttcsid`, `ttcsid_*`	TikTok	Groups the pages you view into a single visit	13 months	HTTP Cookie
`lastExternalReferrer`, `lastExternalReferrerTime`	Meta	Where you arrived from, and when	Persistent	HTML Local Storage
`_gcl_ls`	Google Ads	A copy of the reference from a Google ad you clicked	Persistent	HTML Local Storage
`tt_sessionId`, `tt_pixel_session_index`, `tt_appInfo`, `tt_pixel_is_enrich_*`	TikTok	References for the visit you are in the middle of	Session	HTML Session Storage
`tl-clickids`	Tacit Labs	The reference from an advertisement you clicked to reach us, held for the rest of the visit so the tags above can report which advertisement it was. Read from the address bar and kept in memory until you accept Marketing; nothing is written here if you refuse	Session	HTML Session Storage

6.3 The last four rows are browser storage other than cookies, treated the same way by the rules and removed on withdrawal exactly as the cookies are. What the tags report, the hashed-email confirmation report, who is responsible for which stage, and each provider's transfer safeguards are set out in our Privacy Policy.

7.1 Separately from everything above, every page loads Cloudflare Web Analytics, which sets no cookies, stores nothing on your device, and does not need your consent. It is described in full under "Cookie-free site measurement" in our Privacy Policy. Refusing either consent category does not affect it, because it never engages your consent in the first place.

8. Contact

8.1 The data controller for both sites is Tacit Labs Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ; write to privacy@tacitlabs.co.uk with any question about this notice. Our representative in the European Union, your rights, and how to complain are set out in our Privacy Policy.

9. Changes to this notice

9.1 We may update this notice from time to time; the "Last updated" date at the top reflects the most recent change. If we add a cookie or change what an existing one does, we will update this notice and, where the change is material, ask for your consent again.