Cookie policy
The short version
The pages you are reading now set no cookies at all. The application sets three, all of them needed to sign you in and keep the sign-in form safe. There is no advertising, analytics or tracking cookie anywhere, nothing is shared with anyone else, and our fonts are served from our own server rather than a font network, so reading this site sends your details to nobody.
Why there is no banner
The Privacy and Electronic Communications Regulations require your consent before a site stores information on your device, unless that storage is strictly necessary to provide a service you have asked for. Signing you in is a service you have asked for, and the three cookies below exist only to do that. So consent is not required, and we do not ask for it. If we ever add a cookie that does need consent, we will ask first, and this page will change.
The cookies
| Name | What it does | Set when | Lasts |
|---|---|---|---|
| authjs.session-token | Keeps you signed in to the app. | You sign in | Up to 30 days, or until you sign out |
| authjs.csrf-token | Stops another site submitting the sign-in form as you. | You open the sign-in page | Until you close your browser |
| authjs.callback-url | Remembers which page to return you to after signing in. | You open the sign-in page | Until you close your browser |
On the live site these names carry a "Secure" or "Host" prefix, which tells your browser to send them only over an encrypted connection. They are marked so that scripts on the page cannot read them.
Not a cookie, but stored on your device
If you make or import a signing key in the app, it is kept in your browser's own storage on your computer, not in a cookie and never on our servers. That is the point of the design: your key never leaves your PC. It is stored because you asked the app to store it, it can be removed from the Signing page at any time, and clearing your browser's site data removes it too.
The app also remembers a few conveniences in your browser, such as which tab you last had open. None of this leaves your device.
Your cookie choices
| Category | What it is for | Your choice |
|---|---|---|
| Strictly necessary | Signing you in and protecting the sign-in form. The three cookies listed above. | Always on. Turning these off would stop the app working. |
| Analytics | Measuring how the site is used. | Not used. Nothing to switch. |
| Advertising | Tracking you for adverts. | Not used. Nothing to switch. |
Because there is nothing optional, we do not show a consent banner; showing one with no real choice in it would be theatre. If we ever add an optional category, a switch for it will appear here and we will ask before setting it.
Sign out of the app and end the session cookie
Signing out deletes the session cookie immediately. The two sign-in protection cookies are session-only and go when you close your browser.
Controlling cookies
You can delete or block cookies in your browser's settings. If you delete the session cookie you will simply be asked to sign in again. If you block cookies from this site entirely, you will not be able to sign in to the app, because the sign-in cannot work without them; the public pages will still work.
Changes
If we add analytics in future, we will use the least intrusive option available and this page will say exactly what is collected. Where the law lets us use low-risk statistics cookies without consent, we will still tell you here and give you a way to opt out.
Effective 9 September 2026. See also our privacy policy.