Legal
Cookie policy
Last updated
Cookies and similar technologies (such as your browser's local storage) let a website remember things on your device. We only use what is strictly necessary to run the site, unless you opt in to an optional category: analytics and, when we switch it on, "Affiliate & marketing" (the script of our affiliate partner Skimlinks, which uses its own cookies to track clicks on retailer links). We never use ad-targeting cookies. Each item below says exactly when it can be set.
This list is generated from the same register the website's code is checked against — if the code uses a cookie or storage key that is not listed here, our automated tests fail.
You can change your choice at any time with the button below, or delete cookies in your browser's settings. Blocking strictly necessary cookies means the site will ask for your cookie choice on every page.
Everything we store on your device
| Name | Type · set by | Purpose | How long |
|---|---|---|---|
| hwh_consentAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers your cookie choice (essential only, or which optional categories you allowed: analytics, affiliate & marketing) so we do not ask on every page. Value: v1:essential, v1:analytics, v1:affiliate or v1:analytics+affiliate — nothing else. | 180 days, then we ask again |
| hwh_themeAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers the colour theme you picked with the sun/moon button (value: light or dark — nothing else), so pages load in that theme. Only set when you press the button; without it the site is white. Under PECR this is strictly necessary to provide the setting you asked for, so it needs no consent. | 1 year (choosing again renews it) |
| hwh_regionAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers the shopping region you picked with the region switcher or the “Shopping from …?” prompt (value: uk or us — nothing else), so we show you that region’s retailers and prices and take you to the same page in your region. Only set when you choose a region; we never set it from your location. Under PECR this is strictly necessary to provide the setting you asked for, so it needs no consent. | 1 year (choosing again renews it) |
| hwh:recent-searchesAll visitors | Local storage · first-partyHotWhatHow | Functional. Your last five searches, shown when you open the search box. Stays in your browser — it is never sent to us. Cleared with “Clear recent searches” or by clearing site data. | Until you clear it |
| __Host-hwh_adminStaff only | Cookie · first-partyHotWhatHow | Strictly necessary. Staff sign-in session for the admin area only (random token; we store only its hash). HttpOnly, Secure, SameSite=Lax. Never set for visitors. Named hwh_admin on non-https development machines. | Ends at sign-out, after 2 h idle or 12 h at most (configurable) |
| Skimlinks cookies (skimresources.com)Only after you allow “Affiliate & marketing” | Cookie · third-partySkimlinks — our affiliate partner, only if its script is enabled | Affiliate & marketing (opt-in). Set by the Skimlinks script on Skimlinks' own domains (skimresources.com, redirectingat.com) to record that you clicked a retailer link from HotWhatHow, so the retailer's commission can be attributed to us, and to count link clicks. Names and contents are decided by Skimlinks — see their privacy and cookie policy. Normally only after you allow “Affiliate & marketing”; withdrawing consent stops the script on our pages (clear their cookies in your browser).Needs your consent | As set by Skimlinks (see their cookie policy) |
| __cf_bmOnly when Cloudflare's protection is active | Cookie · third-partyCloudflare (our CDN / security provider) | Strictly necessary. Set by Cloudflare's bot protection, when it is active, to tell people from automated traffic. Not used by us for anything else. | 30 minutes |
| cf_clearanceOnly when Cloudflare's protection is active | Cookie · third-partyCloudflare (our CDN / security provider) | Strictly necessary. Set only if Cloudflare shows you a security check, to remember that you passed it. | Up to 30 minutes (Cloudflare setting) |
Analytics: none are enabled, so no analytics cookies or scripts are used at all. Cookies of optional services that are not in use are not listed.
Affiliate & marketing (Skimlinks script): loaded only after you choose “Affiliate & marketing”.
Not cookies
- Form protection (CSRF): Admin forms carry a signed hidden field tied to the session — no extra cookie.
- Click counting on “View deal”: Recorded on our server when you click (see the privacy notice) — no cookie or storage on your device.
- Rate limiting: A salted hash of your connection address is held in server memory for at most one hour — never written to disk or the database.