Version 2.0 · In effect from 20 August 2026 · Last updated 20 August 2026
The short version
HDQTRS sets no advertising cookies and no analytics cookies. There is no tracking pixel, no third-party tag manager, and nothing that follows you to another website.
What we do set is the cookie that keeps you signed in, a cookie remembering the choice you made here, and a handful that remember interface preferences you changed yourself — your theme, your sort order, which inbox you had open.
What cookies are
A cookie is a small text file a website asks your browser to keep and send back on later visits. Some are deleted when you close the browser (session cookies); others carry an expiry date and survive a restart (persistent cookies).
This policy also covers local storage, which works differently under the bonnet but raises the same question — something is being kept on your device — and so is disclosed here on the same terms. Where an item below is local storage rather than a cookie, the table says so.
Every cookie we set
This is the complete list. It is generated from the same definitions the application uses, so it cannot quietly fall out of date.
| Name | Type | Category | What it does | Why no consent prompt | Kept for | Scope |
|---|---|---|---|---|---|---|
| hdqtrs-auth (plus .0, .1 … continuation cookies) | Cookie | Strictly necessary | Holds your signed-in session so the app knows who you are, and so a login in one HDQTRS sector is recognised by the others. | You cannot use an account without being signed in. Keeping it beyond the current browser session is the one part you choose. | Browser session by default; 30 days if you choose "Keep me signed in" | .hdqtrs.app |
| hdqtrs-cookie-consent | Cookie | Strictly necessary | Records the cookie choice you made, so we do not ask again on every visit. | Required to honour your choice. Storing a refusal is itself exempt. | 365 days | .hdqtrs.app |
| ftr-theme-mode | Cookie and local storage | Functional | Remembers whether you use the light or dark interface. | Written only when you change the theme yourself. | 30 days | .hdqtrs.app |
| ftr-accent-mail | Cookie and local storage | Functional | Remembers the accent colour you picked for Mail. | Written only when you pick an accent colour. | 30 days | .hdqtrs.app |
| ftr-sort-order | Local storage | Functional | Remembers how you like your message list sorted. | Written only when you change the sort order. | Until you clear your browser storage | mail.hdqtrs.app |
| ftr-active-inbox | Local storage | Functional | Remembers which mailbox you last had open, when you have access to more than one. | Written only when you switch mailbox. | Until you clear your browser storage | mail.hdqtrs.app |
| ftr-mail-saved-email | Local storage | Functional | Stores your email address on the sign-in form. Your password is never stored. | Written only if you tick "Remember my email". | Until you sign in with a different account or clear your browser storage | mail.hdqtrs.app |
| email-draft | Local storage | Strictly necessary | Keeps an unsent message on your device so a refresh or a crash does not lose your work. | Part of the compose feature you asked for by opening it. | Until the message is sent or discarded | mail.hdqtrs.app |
| sidebar:state | Cookie | Functional | Remembers whether you collapsed the navigation sidebar. | Written only when you collapse or expand the sidebar. | 7 days | mail.hdqtrs.app |
Scope. The sign-in cookie is scoped to .hdqtrs.app rather than to a single application. That is what lets one login be recognised across every HDQTRS sector. It holds an access token and a refresh token, is sent only over HTTPS, and is set with SameSite=Lax.
Categories, and why there is no wall
Cookie rules turn on one distinction: whether something is strictly necessary for a service you asked for, or whether it is doing something extra. Only the second kind needs consent before it is set.
- Strictly necessary. The sign-in cookie, and the cookie recording your answer here. Without the first you cannot have an account session at all; the second exists only to honour the choice you made, and storing a refusal is itself exempt.
- Functional. Theme, accent, sort order, active inbox, unsent drafts. Each is written only at the moment you change that setting yourself, and each holds a preference rather than anything identifying.
- Analytics and advertising. None. We do not measure you, profile you, or sell anything about you, and there is no third-party script in a position to.
Because no category requires prior consent, there is no cookie wall and no "reject all" button that would meaningfully change what is stored. Offering one would imply we set tracking cookies that you could switch off, which would be untrue.
The one choice we ask you to make
When you first arrive, HDQTRS asks whether your sign-in should outlive the browser session. Both options sit side by side, the same size, one click each.
- Keep me signed in. The session cookie is given a 30-day lifetime and survives closing your browser. Convenient on your own machine; a poor idea on a shared one.
- Session only. The session cookie carries no expiry and your browser drops it when you quit. You will sign in again next time.
Declining is not a degraded experience. Every feature works either way — the only difference is how often you type your password.
Changing your mind
Withdrawing consent must be as easy as giving it, so it is one button rather than a support request. This reopens the banner and applies your new answer immediately, with no need to sign out and back in.
Switching to Session only strips the expiry from the sign-in cookie you already hold, so the change takes effect on the session you are in rather than the next one.
Controlling cookies in your browser
You can block or delete cookies for this site at any time in your browser settings, and you do not need our cooperation to do it. Look for "Cookies and site data" under privacy settings in Chrome, Edge, Firefox or Safari.
Because we set no advertising or analytics cookies, industry opt-out tools such as Your Online Choices have nothing to opt you out of here.
Third parties
HDQTRS runs on infrastructure operated by others, and two of those providers appear in the table above because their cookies reach your browser as part of delivering the service. They act as our processors on documented instructions, not as independent controllers, and none of them receives data for their own advertising purposes.
No embedded social buttons, no comment widgets, no fonts fetched from a third-party CDN at runtime — typefaces are self-hosted precisely so that loading a page does not announce your visit to anyone else.
Changes to this policy
If we add, remove or re-purpose a cookie, this page changes in the same release. The table is generated from the application's own definitions, so it reflects what the current build actually sets rather than what someone remembered to write down.
If a change ever introduced a cookie that required consent, we would ask you before setting it — not add it quietly and update this page afterwards.
Contact
Questions about this policy, or about anything on your device that you think we have not explained, go to [email protected].
If you are in the UK or the EEA and are not satisfied with our answer, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk.