Cookies

This page exists because a privacy notice that says "we use cookies" when you do not is itself a kind of inaccuracy. Here is the complete list.

Cookies set for visitors

None. There is no cookie banner on this site because there is nothing to consent to. No analytics cookie, no advertising identifier, no A/B testing cookie, no embedded third-party widget that sets one.

Cookies set for administrators

The administration console sets one cookie: a session cookie that keeps the operator logged in. It is HttpOnly (script cannot read it) and SameSite=Lax (it is not sent with cross-site requests), and it expires when the session ends.

This cookie is only ever set after signing in to the console. A normal visitor to this website will not receive it.

What is used instead of cookies

Two things do similar work without a cookie:

• Rate limiting uses a salted hash of the requesting address, held server-side. Nothing is stored on your device and the hash is not reversible without the installation's salt.
• Logs record requests for security and capacity, as any web server does. They are not used to build a profile of you and are not shared for advertising.

If that changes

If analytics is ever added, this page will say what was added, why, and how to refuse it — and it will be opt-in, before anything is set. The date below is the date this page last changed, not a date on which the answer changed.