Cookie policy
Two cookies exist on this site, both of them for people who sign in. If you never sign in, you never get one.
Why there is no cookie banner
Consent banners exist because most sites set cookies you did not ask for, usually for analytics or advertising. This site sets none. There is no Google Analytics, no advertising network, no remarketing pixel, no embedded social widget and no third-party tracker.
The only cookies here are strictly necessary for a feature you chose to use, namely signing in, and strictly necessary cookies do not require consent. Rather than showing a banner that asks permission for something that is not happening, we have written this page.
The cookies in full
| Name | What it does | When it is set | How long it lasts |
|---|---|---|---|
hdi_session | Keeps you signed in while you move between pages, and carries the token that protects forms against cross-site request forgery. | Only when you sign in. | Until you sign out or the browser session ends. |
hdi_remember | Optional. Lets the site recognise you on a later visit so you are not signed out every time, if you tick remember me. | Only if you choose it at sign-in. | 30 days, then it expires. |
Both are first-party cookies set by this domain. Both are marked HttpOnly, so JavaScript cannot read them, and SameSite Lax, so they are not sent along with requests started by another site. Neither is used to track you anywhere.
What is not set
No analytics cookie. No advertising or remarketing cookie. No social sharing cookie, because the share links are plain links rather than embedded widgets. No consent cookie, because there is no consent to record. No fingerprinting.
Reading articles, browsing the room hubs, searching, subscribing to the newsletter and sending a contact message all work without a single cookie being set.
Local storage and similar technologies
Where the interface needs to remember something small and harmless, such as a panel you collapsed, the browser's own local storage may be used. That data stays in your browser, is never sent to the server, and is cleared when you clear site data.
Third-party requests
One thing loads from outside this domain: comment avatars are fetched from gravatar.com. That request sets no cookie here, but gravatar.com receives your IP address and user-agent, as any remote image would. Typefaces are downloaded at build time and served from this domain, so no font request leaves the site.
The privacy policy explains the Gravatar hash and what it does and does not reveal.
Controlling cookies
Every browser lets you view, block and delete cookies, usually under privacy or site settings. Blocking cookies for this domain costs you nothing unless you want to sign in, in which case the sign-in will simply not hold.
Signing out clears the session cookie, and clearing site data removes both cookies immediately.
If this changes
If a cookie is ever added that is not strictly necessary, this page will be updated before it is set, and consent will be asked for properly rather than assumed. We would rather not get there.