CRYPTOGRAPHIC READINESSCookies
Cookie Policy
Last updated 26 August 2026
This policy describes cookies and similar storage used with the PostQure website, the PostQure console and Cognito sign-in. It lists only storage that is actually used.
What this site does and does not store
The marketing application does not call document.cookie or sessionStorage. After a visitor accepts the cookie notice or saves preferences, the site writes one first-party localStorage key named postqure.cookie-consent. That value records that necessary storage was acknowledged and whether marketing was opted in. It does not enable analytics cookies or extra marketing pixels.
A successful enquiry is remembered only in page memory so the same form contents are not sent twice in that visit. That memory is not written to cookies or web storage.
No analytics, advertising, social pixel or tag-manager script is present on the marketing site.
Storage inventory
The table lists storage that is actually used, or third-party storage that a used provider may set on its own domain. Where a provider sets its own cookie names or lifetimes, those values are described as provider-set.
| Name | Provider | Purpose | Classification | Duration | Domain |
|---|---|---|---|---|---|
| postqure.cookie-consent | PostQure marketing site | First-party localStorage key written after Accept, Necessary only, or Save preferences. Records necessary acknowledgement and a marketing preference boolean so the notice bar does not keep appearing. It does not load extra marketing pixels. | Necessary preference | Until the visitor clears site data | postqure.com and www.postqure.com (localStorage — not a Set-Cookie header) |
| Cloudflare Turnstile cookies (names set by Cloudflare) | Cloudflare Turnstile | Bot check so a launch enquiry can be accepted. The script loads only when the enquiry form is shown and a Turnstile site key is configured. | Essential for submitting an enquiry | Set by Cloudflare | challenges.cloudflare.com and related Cloudflare domains |
| oidc.* keys in sessionStorage | PostQure console (oidc-client-ts) | OpenID Connect authorization-code and PKCE state, including the signed-in user record after Cognito returns to the console. | Essential for console authentication | Browser session (until the tab is closed or the console clears it) | app.postqure.com sessionStorage — not a cookie |
| postqure.signedOut | PostQure console | Records that the user signed out so the console does not immediately restore a previous session. | Essential for console sign-out | Browser session | app.postqure.com sessionStorage — not a cookie |
| Amazon Cognito hosted-UI cookies (names set by Amazon Cognito) | Amazon Cognito | Hosted sign-in pages for the console. Those pages are not the marketing site. | Essential for console sign-in | Set by Amazon Cognito | the Cognito hosted UI hostname |
Public marketing site
postqure.com and www.postqure.com serve a static export. They do not set first-party cookies for navigation, language or analytics.
When the launch form is rendered with a configured site key, the page loads `https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit` and shows the Turnstile widget. That is a third-party bot-management check used so the enquiry API can reject automated submissions.
Cloudflare may set cookies on its own domains. Cloudflare’s notices apply to data they receive. ICO PECR guidance allows storage that is strictly necessary to provide a service someone has asked for. Turnstile is treated as essential to submitting the enquiry form.
PostQure console and sessionStorage
https://app.postqure.com is a separate single-page application. It stores OpenID Connect state in sessionStorage (oidc.* keys) and a signed-out flag (postqure.signedOut). That storage is not shared with the marketing site.
The console does not add analytics or marketing pixels.
Cognito hosted UI
Console sign-in uses Amazon Cognito hosted pages on a Cognito domain. Those pages may set cookies that Amazon Cognito defines. They are not first-party cookies on postqure.com and are not controlled by the marketing footer.
How to control storage
You can refuse the launch form if you do not want Turnstile to run. Closing the tab clears marketing page memory and console sessionStorage.
Browser controls can block third-party cookies. Blocking Cloudflare cookies may prevent an enquiry from being submitted.
The cookie notice bar includes a settings control for Necessary (always on) and Marketing (off until opted in). This Cookie Policy is the record of that storage.
Changes
This policy was last updated on 26 August 2026. If non-essential analytics or similar technology is added later, it will not load before consent, and equally prominent accept and reject controls will be provided.