One cookie, and measurement that stores nothing.

Auction Pack Review sets one cookie of its own: the account session that keeps you signed in. There are no advertising cookies, no marketing pixels and no cross-site tracking.

Measurement of which pages people use is cookieless. It stores nothing on your device, so there is nothing to accept or refuse and no banner to dismiss.

These are set because the service cannot work without them. Under the Privacy and Electronic Communications Regulations they do not require consent.

__Host-apr_session

Keeps you signed in to your account and enforces owner-only access. Set when you sign in. HttpOnly, Secure and SameSite=Lax, so it cannot be read by scripts and is not sent from other sites. Expires after 30 days. On a local development server the same cookie is named apr_local_session.

Cloudflare Turnstile

Our sign-up, sign-in and password-reset forms use Cloudflare Turnstile to tell people from automated abuse. Cloudflare may set a short-lived cookie of its own to remember that a check has already been passed, so you are not challenged repeatedly.

The protection against cross-site request forgery does not use a cookie: that token is held inside the account session instead.

APR uses Vercel Web Analytics and Vercel Speed Insights to see which pages people use and how quickly those pages load. Vercel Inc. acts as a processor for this measurement.

Both are cookieless. They set no cookies and write nothing to your browser’s storage, so they cannot follow you between sites or between visits. Because they store nothing on your device, they fall outside the consent requirement in regulation 6 of the Privacy and Electronic Communications Regulations and run on all visits as essential measurement.

What is sent is deliberately narrow. Page addresses are matched against a fixed list of known routes before they leave the browser: query strings and fragments are removed, addresses we do not recognise are dropped rather than guessed at, and identifiers in addresses such as a review or report reference are replaced with a placeholder. Nothing from an auction pack, a report, a form field or an account reaches this measurement.

APR does not use advertising or marketing cookies, conversion pixels, session recording, heat mapping, or audience-building tools, and does not sell or share personal data for advertising.

If that changes, this notice will name the tool, the provider, the purpose and the duration before anything is set, and APR will ask for your consent first. Consent will be requested separately and will not be implied by continued use of the site or by acceptance of the Privacy Notice.

Every major browser lets you view, block and delete cookies for a site. Blocking the account session cookie will sign you out and prevent sign-in, because the service uses it to know that a request belongs to you.

Questions about this notice can go to support@auctionpackreview.com. The Privacy Notice explains the wider picture, including the lawful bases we rely on, how long data is kept and how to exercise your rights.