Cookies & local storage
1. The legal position, plainly
Storing information on, or reading information from, your device is regulated in the UK by Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Regulation 6 says we must tell you clearly what is stored and why, and get your consent — unless the storage is strictly necessary to provide a service you have explicitly asked for.
Two things follow from that, and we want to be straight about both:
- We never ask you to consent to tracking, because there is none to consent to. No advertising identifiers, no cross-site cookies, no analytics beacons, no social widgets, no fingerprinting, no data sold or shared. The third-party analytics loader shipped with this site is switched off in code and makes no network request.
- Nothing in the list below is written until you use the feature it belongs to. Open a page and read it, and nothing but the notice acknowledgement and the offline cache is created. Run an analysis, and the analysis is saved — on your device — because saving it is the service you asked for. That is the Regulation 6 exemption doing exactly the job it was written for.
Where a key is a convenience rather than a strict necessity, we say so in the Basis column instead of stretching the word "essential". Those keys only ever appear as a direct result of you using that feature, and you can remove all of them at any time using the button in section 5.
2. Cookies
Count: zero. No page on lexun.co.uk writes a cookie, and no third-party script runs that could write one. If you inspect document.cookie on any LEXUN page you will find it empty. Our host (Netlify) serves the site from its CDN and keeps standard server request logs, which do not involve storing anything on your device — see Privacy & your rights for what those logs contain and how long they are kept.
If a signed-in account ever ships, it will need a session cookie. It does not exist today, and this page will list it before it is ever set.
3. Local storage we set
This is the complete list, taken from the source code rather than from memory. Local storage has no expiry date — the browser keeps it until it is deleted, so "how long" means what actually removes it.
3.1 The decision platform (/platform)
| Key | What it holds | Basis | How long |
|---|---|---|---|
| lexunp.vault.v1 | The same track record as the row below, but encrypted: AES-256-GCM under a key derived from your LEXUN Key passcode by PBKDF2-HMAC-SHA256 at 600,000 iterations. The record also holds the salt, the nonce, the iteration count and the email address you signed up with, none of which are secret. Your passcode is not stored, here or anywhere — which is why nobody, including us, can decrypt this for you. | Strictly necessary | Until you erase it |
| lexunp.graph.v1 | Your decisions, frozen forecasts, reported outcomes and the audit trail linking them. This is your track record. Written in the clear only while you have no LEXUN Key; when you create one, this content moves into the encrypted record above and this key is removed. | Strictly necessary | Until you erase it, or until you create a LEXUN Key |
| lexunp.signup.pending.v1 | The email address and marketing choice from a sign-up whose network request failed, so it can be sent once on your next visit. Deleted the moment that retry is attempted, whether or not it succeeds. Never contains your passcode. | Strictly necessary | Until the single retry, or until you erase it |
| lexunp.profile.v1 | The local profile you fill in (display name, focus area) for your dashboard. | Strictly necessary | Until you erase it |
| lexunp.events.v1 | A local-only activity log ("simulation run", "challenge opened") that drives the in-app improvement suggestions. Never transmitted anywhere. | Functional | Until you erase it |
| lexunp.tasks.v1 | Improvement tasks the app generated from your own usage. | Functional | Until you erase it |
| lexunp.acceptance.v1 | Whether you said you would act on a recommendation, so your calibration record can tell decisions from outcomes. | Functional | Until you erase it |
| lexunp.reminders.v1 | The review dates you set on a decision, so the app can prompt you to record what actually happened. | Functional | Deleted per decision once its outcome is recorded; otherwise until you erase it |
| lexunp.ask.count.v1 | A single number: how many of the free assistant messages you have used on the dashboard sign-in screen. It is a courtesy counter, not a lock — clearing your browser data resets it, and we are not going to pretend otherwise. It is never transmitted, contains no message text, and identifies nothing about you. | Functional | Until you erase it |
| lexunp.theme | Your light/dark display choice. | Preference | Until you erase it |
3.2 Site-wide
| Key | What it holds | Basis | How long |
|---|---|---|---|
| lexun.storageAck | An ISO timestamp recording that you acknowledged the storage notice, so it is not shown to you on every page. Contains no identifier. | Strictly necessary | Until you erase it |
| lexun.cookieConsent | The earlier name for the same acknowledgement. Still read so that people who dismissed the notice before this release are not asked again; no longer written. | Strictly necessary | Until you erase it |
3.3 The single-purpose tools
| Key | What it holds | Basis | How long |
|---|---|---|---|
| lexun.findmoney | Your answers on the Find My Money checklist, run for yourself. | Functional | Until you erase it |
| lexun.findmoney.family | The same checklist when you run it on behalf of a family member. Kept separate so the two sets never mix. | Functional | Until you erase it |
| lexun.jobsafe.last | The result band and timestamp of your most recent "is my job safe" check, so returning to the page shows where you left off. | Functional | Until you erase it |
| lexun.so.mine | Second-opinion forecasts you have made on other people's questions, so you can see how your own calls score. | Functional | Until you erase it |
| lexun.plan | Which tier the checkout confirmation page was reached with, and when. Written on return from payment so the app shows the right state. It is a local flag, not proof of entitlement. | Functional | Until you erase it |
| lexun.runs | A count of how many full decision runs have been produced in this browser, so the free allowance can be shown to you. It is a number and nothing else — no decision content, no inputs, no results. Because it lives in your browser rather than on a server, it is a courtesy meter rather than an enforced limit, and clearing your browser data resets it. | Functional | Until you erase it |
3.4 Session storage — cleared when you close the tab
| Key | What it holds | Basis | How long |
|---|---|---|---|
| lexun.pendingQ | The question you typed on the home page, carried across to the platform so you do not have to type it twice. | Strictly necessary | Deleted the moment the platform reads it |
| lexun.pendingRun | A forecast you ran on the home page and then asked to freeze — the numbers you entered, which of them were facts and which were assumptions, and the model that ran. It is written only when you click “Freeze this forecast”, and it never leaves your browser. | Strictly necessary | Deleted the moment the platform reads it |
| lexun.pendingReceipt | The inputs from a shared result you asked to re-run, carried from the reproduce page to the platform. | Strictly necessary | Deleted the moment the platform reads it |
3.5 Offline cache
| Store | What it holds | Basis | How long |
|---|---|---|---|
Cache Storage: lexun-v39 | Copies of pages, stylesheets, fonts and scripts so the site loads fast and still works without a connection. Contains published site files only — none of your data. | Strictly necessary | Replaced on each release; the previous cache is deleted automatically |
4. What we do not store
- No cookies of any kind, first-party or third-party.
- No advertising or marketing identifiers, and no membership of any ad network.
- No cross-site tracking, browser fingerprinting or device IDs.
- No IndexedDB databases.
- No third-party scripts, embeds, fonts or pixels. Typefaces are served from our own domain precisely so that loading a page tells nobody else you were here.
- Nothing you type into an analysis is transmitted to us. It is computed in your browser and stored in your browser.
5. Erasing everything
You have three routes, and none of them requires asking us:
- The button below removes every key listed on this page, plus the offline cache, from this browser.
- In the app: Platform → Settings → delete all data.
- In your browser: clear site data for lexun.co.uk. This achieves the same thing by a different route.
Erasing is irreversible and there is no server copy to restore from. That is the trade the local-first design makes: nobody can read your record, and nobody can recover it for you either. Export from the platform first if you want to keep it.
Erase all LEXUN storage on this device. This removes every key listed above and the offline cache. It cannot be undone.
6. Changes and complaints
If we ever add storage, this page changes before the storage ships, and the "last updated" date at the top moves. If you think our use of storage on your device breaks PECR or UK GDPR, tell us at hello@lexun.co.uk and you may also complain directly to the UK regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk
Related: Privacy & your rights · Terms · Security
Archived by LEXUN · CA Capital Limited, registered in England and Wales, company number 10848369. Current Cookies & local storage · lexun.co.uk