Cookies and tracking
Proposed effective date 27 July 2026
Draft — not yet in force
It has not yet been reviewed by counsel. The choices below are live and enforced regardless. We are publishing it now because it describes what actually happens today, and you should be able to read that before it is finalised.
This page lists everything JIMO stores on your device, everything we share with advertising and analytics platforms, and how to change your mind. It is part of our privacy policy.
The short version: we store four things, all of them first-party and necessary. We embed no advertising pixels. What we *do* share with advertising platforms is sent from our server, which is unusual enough that it gets its own section below.
Your choices
You have not made a choice yet, so nothing optional is being shared.
Rejecting changes nothing about how the site works. We cannot recall events already sent to a platform — to reach those, contact the platform directly.
1.What we store on your device
| Name | Purpose and lifetime |
|---|---|
| `token` · `refreshToken` *Local storage* | Keeps you signed in. The first lasts 15 minutes, the second 7 days. Both are removed when you sign out. Strictly necessary. |
| `authUser` *Local storage* | Your name and role, so your account menu renders without waiting for the API. Removed when you sign out. Strictly necessary. |
| `jimo-consent-v1` *Local storage* | Your answer to the cookie banner and the date you gave it. Kept until you clear it. Strictly necessary — without it we would have to ask on every page. |
| `jimo_session` *Cookie* | Records only whether you are signed in, so the server can send you past the sign-in page. Holds no name, ID or role. Expires with the session. Strictly necessary. |
That is the complete list. No advertising cookies, no third-party pixels, no fingerprinting scripts, and nothing that follows you to other sites.
2.The part that is not cookies
Most sites share your behaviour with advertisers by embedding their scripts in the page. JIMO does not. Instead, our server tells the platforms about certain actions — signing up, joining the mailing list, sending an enquiry, booking an inspection, viewing a listing, searching.
Two consequences worth understanding:
- An ad blocker will not stop it. Nothing travels through your browser to the platforms, so there is nothing for a blocker to see. Your choice on this page is the control that works — our API refuses to contact any platform whose category you have not agreed to.
- Nothing is sent until you choose. Not to any platform. Rejecting is a real, enforced answer, not a preference we take under advisement.
Where it goes, if you agree. *Analytics* means Google Analytics. *Advertising* means Meta (Facebook and Instagram), TikTok, LinkedIn, X and Snapchat.
What each event contains. Your email, phone, name and account ID are hashed with SHA-256 first, so a platform can recognise a customer it already knows without receiving your actual details. Your IP address, browser and the page URL are sent unhashed, because the platforms use them to match the event and drop duplicates. Hashing is real protection but it is not anonymisation — see the privacy policy for the honest version of that trade.
3.Changing your mind
Use the panel at the top of this page. It takes effect immediately — the next request your browser makes carries the new answer, and our server acts on it.
Clearing your browser storage also clears your choice, and we will ask again. If we add a category, we ask again too: agreeing to one set of purposes is not agreeing to a different set.
What we cannot do is recall an event already delivered to a platform. Withdrawing consent stops future sharing; to reach what a platform already holds, ask that platform. Meta, Google, TikTok, LinkedIn, X and Snapchat each have their own process for that.
4.Your browser's own controls
You can block or clear storage for any site in your browser settings. For JIMO that will sign you out and lose your consent choice, since both are stored there — the site will otherwise work.
We honour Global Privacy Control where your browser sends it: a GPC signal is treated as rejecting both optional categories, and you do not need to touch the banner.