Nightingale Software Group — Cookie Notice
Effective date: 30 October 2026 · Version: 2026-10-30/v1.1
This notice explains how Luke Otto trading as Nightingale Software Group (and, from incorporation, Nightingale Software Group Limited) uses cookies and similar technologies (local storage, session storage, pixels and scripts) on nightingalesoftware.co.uk, the Admin Centre and our apps. Browser local storage (and session storage) is covered by this notice in the same way as cookies: the same consent rules apply, and each item is listed below. Nightingale Software is a trading name of Luke Otto, a sole trader in England. Contact us at team@nightingalesoftware.co.uk. Phone: 01473 487485.
1. Our approach
- Strictly necessary technologies are used without asking, because the service cannot work without them (PECR regulation 6(4)).
- Everything else — preferences we only set with your consent, analytics, session recording, advertising and referral tracking — is off until you say yes. Nothing non-essential is loaded or stored before you choose "Accept" (or switch the category on in "Preferences").
- "Reject non-essential" is as easy as "Accept all", and you can change your mind any time through Cookie preferences in the website footer.
- Your choice is remembered until you clear it; we ask again at least every 12 months or when this notice changes.
2. What we use
Strictly necessary (always on)
| Name | Type | Set by | Purpose | Lasts | Category |
|---|---|---|---|---|---|
ng-cookie-consent-v1 | Local storage | Website | Remembers your cookie choices so we don't ask on every page | Until you clear it; we ask again at least every 12 months or when this notice changes | Strictly necessary |
ng-theme | Local storage | Website | Remembers the light or dark theme you chose | Until you clear it or change the theme | Strictly necessary (you asked for it) |
ng-roadmap-vote-v1 | Local storage | Website | Remembers that you voted on a roadmap item so your vote is counted once | Until you clear it | Strictly necessary (you asked for it) |
tsr-scroll-restoration-v1_3 | Session storage (first-party) | Website | Remembers your scroll position as you move between pages | Cleared when you close your browser | Strictly necessary |
sb-…-auth-token | Local storage | Admin Centre & apps (Supabase) | Keeps you signed in securely | Until you sign out / session expiry | Strictly necessary |
ng_imp | Cookie (secure, HTTP-only) | Admin Centre | Support-impersonation session marker (only when an authorised support session is active) | Session | Strictly necessary |
sidebar_state | Cookie | Admin Centre & apps | Remembers whether you collapsed the menu | 7 days | Strictly necessary |
| Onboarding tour flag | Local storage | Admin Centre | Remembers you have seen the product tour | Until cleared | Strictly necessary |
Stripe cookies (e.g. __stripe_mid, __stripe_sid) | Cookie | Stripe (on checkout pages) | Fraud prevention and secure payment | Up to 1 year | Strictly necessary |
Cloudflare security cookies (e.g. __cf_bm) | Cookie | Cloudflare | Bot and abuse protection | 30 minutes | Strictly necessary |
Preferences (only with your consent)
| Name | Type | Set by | Purpose | Lasts | Category |
|---|---|---|---|---|---|
ng-exit-intent-v1 | Local storage | Website | Stops our exit pop-up showing to you again | Up to 12 months | Preferences, set only with your consent |
Analytics and session insights (only with your consent)
| Name | Provider | Purpose | Lasts | Category |
|---|---|---|---|---|
_ga and _ga_<ID> | Google Analytics 4 (loaded directly, only after you consent) | Counts visits and measures how the website is used | Up to 14 months | Analytics — consent only, set only after you accept |
Contentsquare analytics and on-site surveys (cookies whose names begin _cs_ or _hj) | Contentsquare | Helps us understand how visitors use the site, and remembers which short surveys you have already answered | Up to 13 months | Analytics, set only after you accept |
ng-attribution-session-v1 (session storage) and ng-attribution-first-v1 (local storage) | Nightingale | Remembers which campaign or page brought you to us | Session / 90 days | Analytics, set only after you accept |
Referral (only with your consent)
| Name | Provider | Purpose | Lasts | Category |
|---|---|---|---|---|
ng_partner_ref (cookie and local storage) | Nightingale | Records which partner referred you, so we can pay them commission | 30 days | Referral, set only after you accept |
If you reject referral cookies, a partner can still be credited by entering their partner code at checkout.
Advertising
We do not currently use advertising cookies. If we add any, they will appear here and will only run with your consent.
3. Google Consent Mode
We use Google Consent Mode v2 with all storage set to "denied" by default. Until you consent, Google tags are not loaded. If you accept analytics, Google Analytics is allowed to set its cookies.
4. Apps and Admin Centre
The Admin Centre and the apps only use the strictly necessary items listed above, so they do not show a cookie banner. If that changes, we will update this notice and ask for your consent first.
GaleCast and Rekuver
These apps use only strictly necessary items. In addition to the shared items above (sign-in token and sidebar_state):
| Name | Type | App | Purpose | Lasts |
|---|---|---|---|---|
galecall.nightingale.sso | Local storage | GaleCast | Keeps your single sign-on session from the Admin Centre | Until you sign out |
galecall.nightingale.sso.pending | Session storage | GaleCast | Holds a sign-in request while it completes | Until the tab is closed |
ng_pkce, ng_state, ng_next | Cookie (secure, HTTP-only) | Rekuver | Protect sign-in from the Admin Centre and return you to the right page | 10 minutes |
rekuver_device_id | Local storage | Rekuver | Identifies the device recording a driver's shift | Until cleared |
rekuver.wait.location-consent | Local storage | Rekuver | Remembers whether the driver has allowed location for waiting-time verification | Until withdrawn or cleared |
pending_offline_punches | Local storage | Rekuver | Holds arrival/departure records made offline until they upload | Until uploaded |
rekuver_gps | IndexedDB (browser database) | Rekuver | Holds location points captured during a shift until they upload | Until uploaded |
5. Browser signals
You can block or delete cookies, and clear local storage, in your browser settings. Clearing ng-cookie-consent-v1 means we will ask for your cookie choices again.
6. More information
See our Privacy Notice (nightingalesoftware.co.uk/legal/privacy) for how we use personal data and your rights, including the right to complain to the ICO.