Cookie Policy
Last updated 7 September 2026
The short version
We set one cookie. It keeps you signed in. There is no analytics, no advertising and no third-party tracking, which is why you are not seeing a consent banner — there is nothing to consent to.
What we set
| Name | Purpose | Type | Expires |
|---|---|---|---|
ak.sid |
Keeps you signed in and carries the anti-forgery token that protects forms | Strictly necessary, first-party | 12 hours, extended while you are active; deleted when you sign out |
It is HttpOnly (JavaScript cannot read it), SameSite=Lax, and Secure in production. It contains an opaque identifier — no personal data.
Stripe
When you go to checkout you leave our site for Stripe's hosted page. Stripe sets its own cookies there, including for fraud prevention, under its own privacy policy. We do not embed Stripe's scripts on our own pages, so nothing of Stripe's runs here until you choose to go there.
Why no banner
Under the ePrivacy rules, consent is required for cookies that are not strictly necessary to provide a service the user has requested. A session cookie that keeps you signed in is strictly necessary, so consent is not required. Showing a banner for it would be theatre.
If we ever add analytics or any non-essential cookie, we will ask first, nothing will fire before you agree, and "Reject all" will be exactly as prominent as "Accept all".
Other storage
We do not use localStorage, sessionStorage, IndexedDB, tracking pixels, browser fingerprinting or any similar technology.
Controlling cookies
You can block or delete cookies in your browser settings. Blocking ak.sid will prevent you
from signing in, because the service cannot then tell one request from another.