Cookie Policy
What we store in your browser and why. This is a short document because the list is genuinely short.
What this says.
Four points, and the fourth is the one most cookie policies avoid stating.
- We use a session cookie to keep you signed in. It is opaque and holds no token your browser could leak.
- We store a small number of functional preferences, such as your theme choice.
- We use Google Analytics 4 to understand how the site is used -- page views and interactions, retained for about 13 months via `_ga` and `_ga_*` cookies. We have not enabled any Google advertising features, and GA4 does not log or store your IP address.
- We still do not use advertising cookies, we do not sell browsing data, and where the law requires consent before analytics cookies are set, analytics runs in a cookieless mode until you give it -- the detail most cookie policies leave out.
This summary is here to be readable. The numbered clauses below are the operative text.
Detail
Authentication
Signing in sets a session cookie. Sessions are managed server-side, so the cookie is an opaque reference rather than a token containing your identity or permissions. That design means a script cannot read a credential out of your browser storage, because there is not one there.
The cookie is required to use the product. Blocking it means you cannot stay signed in.
Functional preferences
We store small preferences that make the interface behave the way you left it, such as theme selection and interface state. These are not used to identify you and are not shared with anybody.
What we do not use
No advertising cookies, no third-party tracking pixels, no cross-site profiling, and no selling of browsing data. Google Analytics 4 is configured with every Google advertising signal denied, so it does not enable any of those either -- this is worth stating explicitly because the absence is unusual enough that people assume otherwise.
Why there is still no consent banner
Consent banners exist to get permission before tracking begins. Google Analytics 4 runs under Consent Mode: where the law requires consent before analytics cookies are set, it runs in a cookieless mode by default and only switches on once consent is granted, so there is nothing a banner would be asking permission for that is not already gated.
If that changes -- for example, if we ever enable advertising signals -- this page will change first, and a banner will appear alongside it rather than instead of it.
Managing cookies
You can clear or block cookies in your browser settings. Blocking the session cookie prevents sign-in, and clearing preferences resets the interface to its defaults without affecting your account or your data.
Ask before you sign.
If your legal or procurement team needs something changed, clarified, or evidenced, contact us and we will answer specifically rather than pointing at this page again.