The short version
Two kinds of cookie are involved here, and they are treated differently.
- Strictly necessary cookies sign you in and keep forms secure. They are always on, because the Service cannot work without them, and under the ePrivacy rules they do not require consent.
- Analytics cookies — Google Analytics — count visits and show us which pages are read. They are set only if you accept them. Nothing is requested from Google, and no analytics cookie exists, until you press Accept analytics on the banner.
Refusing costs you nothing: every part of the Service works identically either way. There is no “reject and lose a feature” arrangement here, and no cookie wall.
Your choice is remembered in your browser's local storage rather than in a cookie — recording that you refused cookies should not itself require one. You can change it at any time using the button below.
Strictly necessary cookies
Set by this site, on this domain, with no consent required.
| Name | Purpose | Lifetime |
|---|---|---|
sessionid |
Keeps you signed in and links your browser to your account. Without it you cannot log in. | Two weeks, or until you log out |
csrftoken |
Security. Proves that a form submission came from this site and not from an attacker's page. | One year |
messages |
Carries a one-off confirmation or error notice across a page redirect. Set only when there is a message, and cleared as soon as it has been displayed. | Until displayed |
language |
Remembers the language you chose from the switcher, so the site stays in it on your next visit. It holds a language code and no identifier. | One year |
All four are first-party cookies, set by this site only. The session and CSRF cookies are marked Secure and SameSite=Lax in production, and the session cookie is HttpOnly, so scripts cannot read it.
Analytics cookies — only with your consent
We use Google Analytics 4 to understand how many people visit, which pages they read, and where the Service is failing them. We do not use it for advertising, we have not enabled Google Signals or ads personalisation, and we do not share analytics data with advertising networks.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes one browser from another so repeat visits are not counted as new people. | 2 years |
_ga_<property> |
Google Analytics | Keeps the state of the current visit — when it started, and whether it is still the same session. | 2 years |
The tag runs in Google Consent Mode with every storage type denied by default. Until you accept, the Google Analytics script is not even downloaded, so your browser makes no request to Google's analytics servers at all.
If you accept and later change your mind, we send Google a withdrawal signal, stop the tag, and delete the _ga cookies we can reach from your browser. Data already collected before you withdrew is not retroactively erased by that action — ask us and we will request its deletion, as described in the Privacy Policy.
The legal basis for analytics cookies is your consent, GDPR Art. 6(1)(a), and it is the only thing on this site that runs on consent.
Third parties that are not cookies
Three things worth naming, because each involves another company seeing your IP address without setting a cookie of its own here:
- Cloudflare Turnstile. The sign-up, log-in, and password-reset forms carry an anti-abuse check from Cloudflare, so that bots cannot mass-create accounts or hammer the login. It loads a script from
challenges.cloudflare.com, which receives your IP address, your browser details, and signals about how the page behaves. Cloudflare states that Turnstile is not used to track visitors across sites and that it does not use this data for advertising. The check is strictly necessary security, not analytics, so it does not sit behind the consent banner — but it only appears on those three forms, never on ordinary pages. - Google Fonts. The site's two typefaces are loaded from Google's servers, so your browser tells Google your IP address and user-agent when it fetches them.
- Stripe. When you start a checkout you are sent to Stripe's own pages, which set their own cookies under Stripe's policy. That happens on Stripe's domain, not ours.
Local storage
One key, cookie-consent, is kept in your browser's local storage. It records whether you accepted or refused analytics and when. It holds no identifier, is never sent to our servers, and clearing your browser data removes it — after which you will be asked again.
Controlling cookies
Use the button at the top of this page to change your analytics choice at any time. Refusing is as easy as accepting, and stays refused until you say otherwise.
Every browser also lets you view, block, and delete cookies in its settings. Blocking the strictly necessary ones has a concrete cost: block sessionid and you cannot stay signed in; block csrftoken and no form on the site will submit. The public pages — the home page, pricing, and these legal pages — remain readable either way.
We treat a Global Privacy Control or Do Not Track signal as no different from doing nothing, because doing nothing already means analytics stays off. There is no opt-out to send: consent has to be given actively before anything is set.
Changes
If we add a cookie that is not strictly necessary, we will update this page and ask for your consent again before setting it. See also the Privacy Policy.