Cookie policy
Last updated: 30 October 2026. This policy lists every cookie TheatrePass sets, what each one does and how long it lasts. It is deliberately short because we set very few. It should be read with the privacy policy.
Your settings
Analytics is on unless you switch it off. Your choice applies to this browser and takes effect at once.
What cookies are
Cookies are small text files a website stores on your device so it can remember things between pages and visits, for example that you are signed in. The law that governs them in the UK is the Privacy and Electronic Communications Regulations 2003 (PECR) alongside UK GDPR. A cookie that is strictly necessary to provide a service you have asked for does not need your consent; anything optional does. All of our cookies are first-party: they are set by our own domain, and no other company can read them.
The cookies we set
| Name | What it does | Type | How long it lasts |
|---|---|---|---|
| sb- followed by our project reference and -auth-token (a long value may be split into numbered parts ending .0, .1 and so on) | Keeps you signed in. It carries your session and the token that renews it, so you do not have to sign in on every page. Set by our sign-in provider on our domain. | Strictly necessary | The session inside it lasts a short period (one hour by default) and is renewed silently while you use the app. The cookie itself is refreshed on each visit and expires 400 days after the last refresh, or as soon as you sign out. |
| sb- followed by our project reference and -auth-token-code-verifier | Completes a sign-in or password reset securely by proving that the link you clicked was requested from this browser. | Strictly necessary | Only while a sign-in or reset is in progress; removed as soon as it completes. |
| tp_ref | Remembers a colleague's invite code when you open their personal invite link, so their invitation is still recognised if you come back and sign up later without the link. It holds nothing but that ten character code and is never used for advertising, profiling or tracking you across other websites. | Functional (referral) | 30 days from the moment you open the invite link. You can remove it by clearing cookies. |
| tp-rail-pinned | Remembers whether you pinned the side navigation open, so each page is drawn at the right width from the start. | Functional | One year from the last time you pinned or unpinned it. You can remove it by clearing cookies. |
| tp-pay-from | Set when you continue to payment from a page that needs a plan: it remembers which of those pages you came from (one word, such as library), so that after paying you can go straight back to it. It is read only by the checkout pages and holds nothing about you or your payment. | Functional | Two hours. It is removed if you then buy directly from the plans page. |
| tp-effective-tier | Set only on TheatrePass staff accounts using the admin area: it remembers which plan view a member of staff is previewing. Ordinary accounts never receive it. | Strictly necessary (staff only) | Until the browser is closed. It is server-only and cannot be read by scripts on the page. |
The referral cookie and the law
We set tp_ref only after you open a personal invite link, and it does nothing except honour the invitation you followed. We treat that as necessary to deliver the invite you asked for, so we do not show a consent banner for it. Our solicitor is confirming that classification before launch. If it is not confirmed we will either drop the cookie and carry the invite code in the link alone, or ask you before setting it, and this policy will be updated first.
Browser storage that is not a cookie
The site and the app also keep a few things in your browser's own storage. Unless an item says otherwise, nothing here is sent to us or to anyone else, and it stays on your device until you clear your browsing data.
- tp-visit-source and tp-visit-landing: where this visit came from (a marketing link's tags or the site that sent you) and the first page you opened. If you then create an account, both are sent with it; a message you send us carries where the visit came from. That is how we know how you found us. Both are cleared when you close the tab.
- tp.interviewerVoice: the interviewer voice you chose for spoken practice.
- tp-last-place-interview and tp-last-place-msra: the last page you had open in each product, so the account menu's switch takes you back there. Both are forgotten when you log out.
- tp-msra-flags: the examination questions you have flagged in this browser, until a synced version replaces it.
- tp-review-sitting-v1: staff accounts only, the progress counter of a content review session.
- tp-stats-off: stored only if you switch analytics off, to remember that choice in this browser.
Analytics
We count visits to our public pages (the home page, specialty and exam pages, guides, and the log in and sign up pages) to see which pages help and where visitors come from. Our analytics provider counts them for us on servers in the EU. It sets no cookies and stores nothing on your device.
It records the page, the site or link that sent you, your browser type and the links and buttons you press on those pages, never what you type. To tell visitors apart without a cookie, it combines your IP address and browser details with a random code that changes every day and is then deleted; your IP address is not kept. These visit statistics are kept for 12 months.
Inside the app we count the pages you open and what you click, including clicks that get no response, which shows us where the app is hard to use. We also keep a recording of the screen in which every word and every picture is hidden, so we can see where something goes wrong without seeing your answers or our material. This is linked to your account number, never your name or email. It is held in the page's memory while you use the app, and nothing is stored on your device. Recordings are kept for 30 days and the rest for 12 months. Account settings, payments and these legal pages are never counted or recorded.
You can switch analytics off at any time under Your settings at the top of this page. We also respect your browser's Global Privacy Control setting.
What we do not set
- No advertising or marketing cookies.
- No third-party tracking or social media pixels.
- No analytics cookies. Our analytics works without them, so we do not show a cookie banner: the law allows statistics that only help us improve the service, as long as we explain them and you can switch them off.
If this changes
If we ever add optional cookies we will update this policy first, list each one here with its purpose and lifetime, and ask for your consent where the law requires it before anything optional is set. Refusing will be as easy as accepting, and nothing will be pre-ticked.
Managing cookies
You can clear or block cookies in your browser settings at any time. Blocking the authentication cookies will sign you out and prevent the app from working, but the public website will still be readable.