Cookie Policy
What is set, what waits for your permission, and how to change your mind
Last updated: October 5, 2026
Nothing measures you until you say yes
Analytics and advertising scripts are not written into the page at all until you have agreed to them. They are not loaded and paused, or loaded with tracking switched off. The tag is simply not there. The same is true of our own server-side page logging. If you never answer the banner, nothing about your visit is recorded beyond what the server needs to serve the page and stay secure. The one exception is a count of your account itself (that it was created and that your email was confirmed), described in the privacy policy.
The categories
Strictly necessary
Your session, the security token that stops form hijacking, your language, your theme, and the record of this very choice. These cannot be switched off, because without them you cannot sign in. When we switch on the Cloudflare Turnstile check on the sign-in, sign-up, password reset, contact and call back request forms, it runs as a security measure in a frame served from Cloudflare's own site; we set no cookie for it, and what that frame stores is described in Cloudflare's own policy. Signing in with Google or Apple adds no cookie of ours beyond your session.
Functional
Remembering preferences that make the product nicer to use but that it works without.
Analytics
Plausible Analytics (which sets no cookies and runs only on our public pages), and our own count of which pages are read, which keeps a cookie for 30 minutes to tell the pages of one visit apart. Used to work out which parts of the product people cannot find. Off until you agree. We do not use Google Analytics.
Marketing
Advertising and cross-site tracking. We do not currently run any. The switch exists so that if that ever changes it is off by default, and so that "reject" means something now.
Changing your mind
Open your privacy choices at any time and change or withdraw what you agreed to. Withdrawing is exactly as easy as agreeing was, which is the point.
You can also clear cookies in your browser. Clearing them removes the record of your choice, so you will be asked again.
Global Privacy Control
If your browser or an extension sends the Sec-GPC signal, we treat it as an opt-out before the page is built. Analytics and marketing are off, the opt-out is recorded so we can show it was honoured, and the banner tells you what happened instead of asking you a question you have already answered.
Third-party cookies
No analytics company sets cookies on our pages: Plausible sets none, and we do not use Google Analytics. While payments are open, our payment provider, Paddle, may set its own cookies inside its checkout window, which opens only when you start a payment. We embed no advertising networks, no social media trackers and no session-recording tools.
Changes
If we add a cookie in a category you have not agreed to, we will ask before it is set.