Summary: The site stores a fair amount on your device, and all of it is there to make the service work or to keep it secure: your language choice, reports waiting for a signal, your sign-in state, caches, and a security cookie set by Google reCAPTCHA Enterprise to keep scripts off the forms. We set no analytics cookies and no advertising cookies. Section 3 lists every key by name. The one exception to "essential" is the video player embedded on a single article page, which is covered in section 4.
1. What Are Cookies?
Cookies are small text files stored on your device by your web browser when you visit a website. Local storage and session storage are similar browser technologies that allow websites to store data locally on your device. These technologies help websites function correctly, remember your preferences, and provide a better user experience.
2. Our Approach
Hydroscape-Group takes a privacy-first approach. We have deliberately designed our platforms to avoid the use of non-essential cookies. We do not use:
- Analytics cookies (no Google Analytics, no Hotjar, no Mixpanel)
- Advertising or remarketing cookies
- Third-party tracking cookies
- Social media tracking pixels
- Any cookies that profile your behaviour across websites
Because what we set is strictly necessary or security storage, the notice on your first visit is for information. Accepting it stores one key on your device and stops it being shown again. Nothing is held back until you accept, and nothing extra starts when you do.
Two things are worth saying plainly. The security check runs when a page loads, not only when you submit a form, so Google receives a request from your browser on every visit to a page that carries a form. And one article page embeds a video player hosted by YouTube, which sets Google's own cookies and storage when that player loads. Section 4 covers both.
3. Cookies and Storage We Use
The following table lists all cookies and browser storage used across our platforms. All are classified as strictly necessary for the services to function.
3.1 Public Site (www.hydroscape-group.co.uk)
| Name / Type | Purpose | Duration | Category |
|---|---|---|---|
Local storage hs_lang | The language you chose, so every page gives you the same one. Set on your first visit, before you touch the notice, because the site has to render in some language. | Persistent until cleared | Strictly necessary |
Local storage hs_cookie_consent | Records that you have seen this notice, so it is not shown again. No personal data. | Persistent until cleared | Strictly necessary |
| Local storage, the five report queues | Holds a report you have filed while there is no signal, so it is not lost. This is the whole report: position, count, species, notes, the photograph, and the name and email address if you gave them. Cleared as soon as the report reaches the server. | Until the report is sent | Strictly necessary |
Local storage hs_observer_name | The name of the person carrying out a deterrent action, so the form can offer it again next time. It is a person's name and it stays on your device. | Persistent until cleared | Strictly necessary |
Local storage emailForSignIn | The email address you typed to get a sign-in link, held so the link can be matched when you come back to it. Deleted once you are signed in. | Until the sign-in link is used | Strictly necessary |
Session storage hs_roost_group, hs_hr_access_denied, hsAuthBridgeStarted | The group code for a counting session, and two flags that stop a page repeating work it has already done. Cleared when the tab closes. | Browser session only | Strictly necessary |
IndexedDB firebaseLocalStorageDb | Your Firebase sign-in state, if you have a MyHydroscape account. Managed by the Firebase SDK. Holds a token and your account details, not a password. | Until you sign out | Strictly necessary |
IndexedDB firebase-app-check-database, firebase-heartbeat-database | The App Check token that shows the page is a real browser, and the SDK's own usage heartbeat. | Token lifetime, then replaced | Security |
IndexedDB hydroreturn | A HydroReturn in progress, held on the device so a return can be completed at a water with no signal. | Until the return is submitted | Strictly necessary |
| Service worker cache | The pages and files that let the site open with no signal. No personal data. | Until the cache is cleared or updated | Strictly necessary |
_GRECAPTCHA, set by Google | Set by Google reCAPTCHA Enterprise as part of Firebase App Check, to tell a genuine browser from a script. Not used for advertising. | 6 months | Security |
rc::a (local storage) and rc::c (session storage), written by Google | Written by Google's reCAPTCHA frame, not by us. Part of the same check. | rc::a persistent, rc::c session only | Security |
None of this is set by an advertising network and none of it follows you to another site. The report queues and hs_observer_name are the two that hold personal data, and both stay on your own device unless and until a report is sent.
3.2 Admin Hub (hub.hydroscape-group.co.uk)
| Name / Type | Purpose | Duration | Category |
|---|---|---|---|
| Firebase Auth session token | Authenticates the admin or client user. Managed by Firebase Authentication SDK. Contains no personal data, only a cryptographic token. | 1 hour (auto-refreshed while active) | Strictly necessary |
| Session storage (portal context) | Stores client portal routing state (e.g. which tool to display). Cleared when the browser tab closes. | Browser session only | Strictly necessary |
| Service worker cache | Caches app files for faster loading. | Until cache is cleared or updated | Strictly necessary |
3.3 HydroTasks (tasks.hydroscape-group.co.uk)
| Name / Type | Purpose | Duration | Category |
|---|---|---|---|
| Firebase Auth session token | Authenticates the user for project access and real-time sync. | 1 hour (auto-refreshed while active) | Strictly necessary |
| Service worker cache | Caches PWA shell for offline access. Essential for use on sites with poor mobile signal. | Until cache is cleared or updated | Strictly necessary |
| Local storage (UI state) | Stores map preferences, last viewed project, and UI settings. | Persistent until cleared | Strictly necessary |
4. Third-Party Cookies
When you use our authenticated platforms (Admin Hub or HydroTasks), Firebase Authentication may set cookies on Google-owned domains (e.g. firebaseapp.com) to manage your session securely. These are first-party authentication cookies essential for the login process to function and are not used for tracking.
If you make a payment via Stripe (contractor subscriptions), Stripe may set its own cookies on the Stripe checkout page. These are governed by Stripe's Privacy Policy and are used solely for fraud prevention and payment processing.
Brevo, Slack, Google Maps and Google Gemini AI are called server-side from our Cloud Functions. They set nothing in your browser and have no client-side presence.
Other third parties do run in your browser, because the page asks your browser to fetch something from them. Each one receives your IP address and the standard request headers. They are Google Fonts, cdnjs, unpkg and gstatic (fonts, icons, the map library and the Firebase SDK), Google reCAPTCHA Enterprise, the OpenStreetMap, CARTO and Esri tile servers, what3words, postcodes.io, Open-Meteo, the Environment Agency, Overpass, and api.country.is on the home page. Of those, only reCAPTCHA stores anything on your device: the cookie and the two storage keys listed in section 3.1. The full list, with what each one receives, is in section 5.2 of the Privacy Policy.
The one video. One article page embeds a YouTube player. When that player loads, YouTube and Google set their own cookies and storage, including an advertising-network cookie, and contact Google's advertising domains. That is the only non-essential storage anywhere on the site, we do not control it, and it is governed by Google's own privacy policy. Nothing on the reporting forms, the maps, the policies or the help pages does this.
If you turn notifications on in MyHydroscape, your browser registers a subscription with the push service run by its own vendor (Google, Apple or Mozilla). That is a browser feature rather than a cookie, and turning notifications off removes it.
5. How to Manage Cookies
Since we only use strictly necessary cookies, disabling them may prevent our platforms from functioning correctly. However, you can manage cookies through your browser settings:
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Manage and delete cookies
You can also clear local storage and service worker caches through your browser's developer tools (usually F12 → Application tab).
6. Changes to This Policy
If we introduce any new cookies or storage, we will update this policy and the "Last Updated" date above. We have no plans to introduce analytics or advertising cookies. If we ever do, we will ask for your consent before setting them rather than telling you afterwards.
7. Contact
If you have questions about our use of cookies, contact us at:
Hydroscape-Group Ltd
Two Hoots, Main Street, Southorpe, Stamford PE9 3BX, United Kingdom
Registered in England and Wales, company number 16894053
Email: info@hydroscape-group.co.uk
See also: Privacy Policy and Terms of Service