Cookie Policy

This Cookie Policy explains how Taupia uses cookies and similar technologies on this website. It should be read alongside our Privacy Policy.

We use a consent mechanism so you can choose whether optional technologies are used. Strictly necessary technologies remain active because they are required for core website operation.

We categorise technologies by purpose:

• Strictly necessary: required for site security, consent memory, and essential functionality.
• Functional: optional features that improve site experience.
• Analytics: optional measurement technologies used to understand how the website is used and improve performance.
• Marketing: optional advertising and campaign technologies.

Optional categories are disabled by default until you make a choice.

Our live chat is provided by Chatway and is treated as strictly necessary, so it is available without waiting for a cookie choice. It loads only on our home page and our Move home and Students pages, and it stores nothing on the pages where it does not load. Where it does load, Chatway loads with the page rather than when you open the chat, and it stores the identifiers listed below from that point, including for visits where you never open a conversation. Everything it stores is listed in the next section.

The list below reflects technologies currently used by Taupia on this website, including Taupia Web, the browser version of the Taupia app at taupia.com/web:

• taupia-consent (cookie, strictly necessary, 180 days): stores your consent choices.
• taupia-consent (localStorage, strictly necessary, 180 days): stores a local copy of your consent state.
• taupia-theme-mode (cookie, appearance preference): shares your chosen theme across Taupia subdomains.
• taupia-theme-mode (localStorage, appearance preference): remembers your chosen theme setting for the current origin.
• taupia.web.theme-mode (localStorage, appearance preference): in Taupia Web, remembers whether you chose a light, dark or system theme. It is kept when you log out.
• taupia.web.app-banner-dismissed (localStorage, appearance preference): in Taupia Web on an Android phone, remembers that you closed the banner offering the Taupia app, so it stays closed. It is kept when you log out.
• taupia.web.chat-open (localStorage, appearance preference): in Taupia Web, remembers whether you left the chat panel open, so on a larger screen it opens again beside the page. Removed when you log out.
• taupia.web.guest-session (localStorage, strictly necessary): in Taupia Web, holds the temporary guest session that lets you use Taupia and keep your answers before you create an account. The session expires after 2 hours, and it is removed when you log in or log out.
• taupia.web.signed-in-hint (localStorage, strictly necessary): in Taupia Web, remembers that you were logged in on this browser, so the right first page shows while your login is restored. Removed when you log out.
• taupia.web.email-code (sessionStorage, strictly necessary): in Taupia Web, keeps your email address, code challenge, marketing preference and verified sign-in credential so signing in can resume after a refresh. The code you enter is not stored. Cleared when sign-in completes, you cancel or the tab closes; a verified credential is used for up to 55 minutes.
• taupia.web.sign-in-completion (sessionStorage, strictly necessary): keeps the guest session and linked result destination while Taupia Web finishes saving your results. Cleared when you log out, it is replaced or the tab closes.
• taupia.web.return-to (sessionStorage, strictly necessary): in Taupia Web, remembers the page to bring you back to after you log in or create an account. Removed once you are logged in, or when you close the tab.
• taupia.web.agent-continuation (sessionStorage, strictly necessary): holds a credential limited to the energy journey opened from a connected agent. Access expires after 2 hours; it is stored until replaced or the tab closes.
• taupia.web.signup-handoff (sessionStorage, strictly necessary): in Taupia Web, when you choose to save a result, keeps a short summary of it, such as an estimated monthly cost or saving, so the sign-up page can show what you are saving. Removed once you are logged in, or when you close the tab.
• taupia.web.chat-conversation (localStorage, strictly necessary): in Taupia Web, remembers which chat conversation you are in, so you can carry on with it on this device. Removed when you start a new chat or log out.
• taupia.web.draft.move-journey, taupia.web.draft.check-journey, taupia.web.draft.shared-home and taupia.web.draft.bill-upload (localStorage, strictly necessary): in Taupia Web, keep your answers to the moving home, bill check and shared home journeys, and what Taupia read from a bill you uploaded, so refreshing the page or logging in does not lose them. They can include an address, a move-in date, your providers and what you pay, contract end dates and the names you give for housemates. They stay on this device until a journey clears them, you log out, or you clear this site’s data.
• tsr-scroll-restoration-* (sessionStorage, strictly necessary): in Taupia Web, remembers how far down each page you had scrolled, so going back takes you to the same place. Cleared when you close the tab.
• firebaseLocalStorageDb (IndexedDB, strictly necessary): Firebase Authentication, the Google service Taupia uses for accounts, keeps you logged in. Taupia Web creates it when it opens, and our sign-up pages create it when you reach the step to create an account. Once you log in, it holds your login record, including your email address and the tokens that keep you logged in, until you log out. If your browser blocks IndexedDB, the same record is kept in localStorage or sessionStorage as firebase:authUser:*. Firebase also writes a __sak test entry and removes it at once, to check that storage works.
• firebase-heartbeat-database (IndexedDB, strictly necessary): Firebase records the days it ran and the versions of its software, and sends them to Google with its next request, then clears them. It holds only those dates and version numbers. Firebase also creates a validate-browser-context-for-indexeddb-analytics-module database and deletes it at once, to check that IndexedDB works.
• ch_* (cookie/sessionStorage, strictly necessary): Chatway visitor, session, and conversation state. Set when the page loads, not only when you open a chat.
• isWidgetVisible and showTextBubble (localStorage, strictly necessary): Chatway remembers whether the chat panel is open and whether you dismissed the chat prompt.
• _bdyF and _scrollY (sessionStorage, strictly necessary): Chatway restores your scroll position after the chat panel closes.
• cdn.chatway.app / prod-api.chatway.app / widgetcdn.chatway.app / widget.chatway.app (live chat network requests): contacted on the pages that offer chat, so it is ready to use.
• ph_* (cookie/localStorage/sessionStorage, analytics): PostHog identifiers and session state used only when analytics consent is granted.
• __ph_opt_in_out_* (localStorage, analytics): stores PostHog opt-in/opt-out state when analytics is configured.
• eu.i.posthog.com / us.i.posthog.com / eu-assets.i.posthog.com / us-assets.i.posthog.com / configured PostHog ingestion host (analytics network requests): used only when analytics consent is granted.
• taupia_guest_switch_v1 (sessionStorage, strictly necessary): remembers the chosen service, opaque journey reference and navigation step in the current tab. It contains no bill, payment or contact details and is cleared when the tab closes.
• taupia-acquisition (sessionStorage, analytics): remembers a random visit ID, public landing path, campaign attribution and external referrer hostname to measure visits through journey starts and supplier-confirmed activations. It contains no full URLs, form values or advertising click identifiers, is used only with analytics consent, and is cleared when you close the tab or withdraw that consent.
• taupia-campaign-params (sessionStorage, marketing): remembers the campaign details in the link you arrived on, such as the utm values and the advertising click identifier, so that an app install later in the same visit can be credited to the right campaign. Cleared when you close the browser tab, and used only when marketing consent is granted.
• _ttp, _tt_enable_cookie, and ttcsid_* (cookie/localStorage, marketing): TikTok attribution and click identifiers used only when marketing consent is granted.
• _gcl_au, _gcl_aw and other _gcl_* cookies, and _gcl_ls (cookie/localStorage, marketing, up to 90 days): Google Ads click and conversion identifiers, set by the Google Ads tag in Google Tag Manager on this website and in Taupia Web, so that an action can be credited to the ad click that led to it. Used only when marketing consent is granted.
• _rdt_cid, _rdt_uuid, _rdt_em, and _rdt_pn (cookie, marketing): Reddit attribution and advanced matching identifiers used only when marketing consent is granted.
• __oppref (cookie, marketing, 30 days from the last captured ad click): connects consented website actions to a ChatGPT ad click. It is removed when marketing consent is withdrawn and is not passed to the native app.
• /api/openai-events (website measurement requests): sends consented page views, download and app handoff clicks, form milestones and accepted energy requests to Taupia’s server, which forwards the limited event to OpenAI. The server does not forward visitor IP addresses, browser identifiers, form contents, bill details or contact details. OpenAI’s browser SDK is not loaded.
• _fbp and _fbc (cookie, marketing): Meta browser and click identifiers used only after marketing consent on advertising landing and app download pages.
• connect.facebook.net and www.facebook.com (marketing network requests): load the Meta Pixel and receive consented page views, form milestones, app handoff clicks, and confirmed switch submissions on advertising landing pages, plus app-store button clicks on the app download page. Form contents are not sent.
• www.googletagmanager.com / analytics.tiktok.com / business-api.tiktok.com / events.reddit.com / pixel-config.reddit.com / alb.reddit.com (marketing network requests): used only when marketing consent is granted.
• www.redditstatic.com (marketing script host): serves the Reddit Pixel runtime when marketing consent is granted.

You can update your preferences at any time by using the Cookie settings button in the website footer.

You can also use browser controls to clear or block cookies. Blocking some technologies may affect how parts of the website function.

For UK visitors, after showing the notice we count key setup screens and button actions to improve the service. We immediately combine these into daily totals by platform and app version, kept for 90 days. We do not retain individual event records, email addresses, account, device or journey identifiers, form answers or link codes in these statistics. They are not used for advertising and are not sent to PostHog or advertising providers.

Choose Reject all, Reject optional, or turn analytics off in Cookie settings to object free of charge. We honour existing analytics refusals. Outside the UK, or when the country is unknown, these counts require analytics consent. Operational authentication and email-delivery records are separate and used to provide and troubleshoot sign-in.

If you have questions about this Cookie Policy, contact us at [email protected].