RotaCheck Cookie and Device Storage Notice
Version 2.0 · Last updated: 15 November 2026
This notice explains how the RotaCheck website and app store information on, or read information from, your device. It is written to meet the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, and should be read with our Privacy Notice.
1. In short
- We do not use advertising, tracking or analytics cookies, on the website or in the app.
- We use only what is strictly necessary to sign you in, keep you secure, take card payments and make the app's on-phone features work.
- Because these are strictly necessary, we do not ask for cookie consent. If we ever want to use anything that is not strictly necessary, we will ask you first and you will be able to say no as easily as yes.
2. The website
| Name or type | Set by | Purpose | How long |
|---|---|---|---|
| Sign-in session (session storage, ends when you close the tab) | RotaCheck | Keeps you signed in while you save or manage your card | Until you close the tab |
Stripe cookies (for example __stripe_mid, __stripe_sid) | Stripe | Fraud prevention and secure card payments on the card page | __stripe_sid 30 minutes; __stripe_mid 1 year |
Stripe acts as a separate controller for its fraud-prevention cookies. See stripe.com/gb/cookie-settings and stripe.com/gb/privacy.
3. The app
The app stores information on your phone to work. This is what makes "on-phone first" possible:
| What | Where on your phone | Purpose |
|---|---|---|
| Hours diary, notes, report copies and PDFs | App storage | Your diary and reports |
| Allocate password (only if you tap Save) | Apple Keychain (iPhone) or Android Keystore (Android), this device only | Filling in Allocate's sign-in page |
| Sign-in token | Secure storage | Keeping you signed in to RotaCheck |
| Your hospital's area and location results | App storage | Recording arrival and departure on your phone |
| Speech-recognition model files | App storage | On-phone dictation |
| Settings and preferences | App storage | Remembering your choices |
The browser extension or add-on keeps what it needs to fill your form in memory for up to 15 minutes and sets two short-lived flags in session storage on the Allocate site. Nothing is sent to us. It does not set tracking cookies on Allocate or any other website.
None of this is sent to us, except the sign-in token, which our server checks each time the app connects.
4. Managing storage
- Website: you can delete or block cookies in your browser settings. If you block the sign-in or Stripe cookies, you will not be able to save a card.
- App: deleting the app deletes everything it stored on that phone. You can remove a saved Allocate password at any time in RotaCheck (Account).
5. Changes
If we change what we store, we will update this notice and, where consent is needed, ask you first.