Cookie Policy

Two cookies. Both necessary. Nothing that tracks you.

This page lists every cookie this website sets, what it does, and how long it lasts. There is no "accept" button anywhere on this site because we set nothing that needs your consent — only what a secure form needs to work.

Last updated: September 2026

1 · Cookies we set

The complete list.

Lifetimes below are read from the site's configuration, so this table cannot drift from what the software actually does.

CookieTypePurposeLifetimeSet when
csrftoken Strictly necessary Protects the contact and review forms from cross-site request forgery — proves a submission came from a page we served you, not from a malicious third-party page. 364 days You open a page with a form.
sessionid Strictly necessary Keeps a signed-in editor logged in to the admin. Never set for visitors. 14 days A member of staff signs in.
traction_optout Preference (your choice) Records that you asked not to be counted in our first-party visit tallies. Contains only the value 1 — no identifier. 1 year Only if you flip the switch below.

// All three are first-party, Secure, SameSite=Lax. The two necessary ones are HttpOnly as well — scripts can't read them. We set no advertising, analytics, or third-party cookies.

2 · Browser storage that isn't a cookie

Two preferences, kept on your device.

  • cookie_notice_dismissed localStorage. Remembers that you closed the small notice at the bottom of the page, so it doesn't reappear. Never sent to us.
  • plausible_ignore localStorage. Reserved for our analytics provider's opt-out; analytics is currently switched off, so this is never set. Never sent to us.
3 · Visit counting, and how to switch it off

Counted in aggregate. Excludable in one click.

Our own server keeps a tally of views per page per day. Neither stores anything that identifies you, which is why no consent is needed — but you have a right to object to processing based on our legitimate interests, and this is that right as a switch rather than an email.

4 · Do Not Track, Global Privacy Control, changes

The rest.

  • DNT / GPC signals We never sell or share personal data, and set no cross-site cookies, so there is nothing for these signals to switch off. We honour them by default.
  • Managing cookies yourself Every browser lets you view and delete cookies for a site. Deleting csrftoken is harmless — it's re-issued on the next form page. Deleting traction_optout switches counting back on.
  • Changes If we ever add a cookie that is not strictly necessary, this page will list it and the site will ask for your consent before setting it — a real choice, not a pre-ticked box. The "Last updated" date above changes whenever the substance of this page does.
  • Related Privacy Policy · Security & Privacy · Terms of Use