Every part of this page starts with something you are entitled to, then says what we do about it. The short version: nothing here counts you, follows you or recognises you on a second visit, and the only two items stored come from the company that keeps the site standing up.
1. Being asked first
Your right
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 says that putting information on your equipment, or reading information already there, needs clear information and your agreement first. The rule does not care what the mechanism is called: local storage, session storage, IndexedDB, pixel tags and device fingerprinting are all caught exactly as cookies are. Avoiding the word avoids nothing.
One exception exists. Agreement is not needed where the storage is strictly necessary for a service you actually asked for. The regulator reads that narrowly. Keeping a site standing up qualifies. Counting visitors does not, no matter how anonymous the counting claims to be.
How to use it
Notice that you have not been asked, and check whether you should have been. Part 2 is the list to check it against, and part 3 tells you how to verify it for yourself instead of taking our word.
Our duty
There is no consent banner on this site because there is nothing here that needs consent. We think putting one up anyway would be worse than leaving it off: it would ask you to agree to nothing, it would train you to dismiss a control that genuinely matters elsewhere, and it would imply activity that is not happening.
If anything outside the exception is ever introduced, we will ask before it loads, make declining exactly as easy as agreeing, keep a record of what was agreed and when, and update this page and its date beforehand rather than afterwards.
2. A complete list, not a sample
Your right
Clear information means the whole list. A statement that gives examples and trails off with "and similar technologies" has told you nothing you can act on.
How to use it
Two items, both from Cloudflare, which serves these pages. Neither is set by us and neither identifies you to us.
| Name | What it does | Lasts | Why no consent is sought |
|---|---|---|---|
| __cf_bm | Tells automated traffic apart from people, so abusive requests can be turned away at the edge | 30 minutes, extended while you keep browsing | Strictly necessary: without it the site is defenceless against the traffic that would take it down |
| cf_clearance | Appears only if you were shown a challenge and passed it, and records the pass so you are not stopped again | Up to 30 days | Strictly necessary: it is the memory of a security check you have already been through |
Our duty
That is the complete inventory, and here is what is absent from it. No visitor counting of any kind, whether from Google, Plausible, Fathom, Matomo or anybody else. No advertising and no advertising cookies. No Meta, LinkedIn or TikTok pixel and no conversion tag. No session replay, heatmap or scroll tracking. No embedded video, map, social button or comment system. Our own code writes nothing into local storage, session storage or IndexedDB. No fingerprinting, and no attempt to work out that you have been here before.
3. Refusing without breaking the page
Your right
Your browser is yours. You may block storage, delete what is there, and inspect exactly what any site has put on your machine, and no website gets a say in it.
How to use it
- Chrome keeps the controls under Settings, then Privacy and security, then Third-party cookies.
- On Safari, look in Settings, then Privacy, then Manage Website Data.
- Firefox files them under Settings, then Privacy and Security, then the Cookies and Site Data panel.
- Edge puts them under Settings, then Cookies and site permissions.
Better still, audit us. Open the Application and Network panels in your browser's developer tools, load a few pages, and hold what you see against the table in part 2. That is worth more than any assurance printed on this page, including this one.
Our duty
Blocking both items leaves the site working. The likely consequence is that Cloudflare challenges you rather more often, which is an inconvenience rather than a lock-out. We will not detect a blocker and nag you about it.
4. Knowing what leaves your browser
Your right
Storage on your device is only half the question. You are also entitled to know what your browser sends outward on a site's instruction, and what the site's own servers write down.
How to use it
Both answers are below, and both are short.
Our duty
The lettering. The type on these pages is fetched from Google's font service, which means your browser tells Google's servers your network address, your browser signature and the page you were on. Google says the service writes no cookie and that it does not use the requests for advertising or profiling. Hosting the files ourselves would remove the request altogether and is on the list of things to do; until it happens, saying so is better than leaving it out. Block those two hostnames and every word here is still readable in a system typeface.
The server's own notes. Every web server records the requests it handles, and ours is no exception: network address, time, path, browser signature, response code. None of that is stored on your device, so regulation 6 is not engaged at all. It is still personal data under the UK GDPR, so it belongs in an honest account. It is kept on the basis of legitimate interests, the interest being to deliver the site and defend it from attack; the host keeps it on its own cycle, currently under a month, and it is joined to nothing else. The privacy guide carries the full retention schedule.
5. Having your refusal signal respected
Your right
Global Privacy Control, and the older Do Not Track header before it, exist so that you can state a preference once in your browser instead of fighting it out site by site.
How to use it
Turn either on in your browser and leave it on. Nothing further is required of you here.
Our duty
Both are honoured, which costs us nothing at all given that there is nothing here to switch off. Sending the signal changes nothing about your visit, and neither does withholding it. We say so anyway, because a site that quietly ignores these headers has made a decision it would rather you did not examine.
6. Being told before this changes
Your right
A statement like this one is worth something only if it is kept current. You are entitled to have it updated before the practice changes, not after somebody notices.
How to use it
The date sits in the panel at the top of the page. If it has not moved, nothing in the table has moved either.
Our duty
Anything new that stores information on your device gets added here, with its date changed, before it goes live, and consent is collected wherever regulation 6 calls for it.
One point about applications, because it is a common confusion. Cookies are a browser mechanism; a mobile application does not use them and nothing on this page describes one. What an application would keep on your device, and what it would send anywhere, is set out in the privacy guide.
7. Complaining about any of it
Your right
If you think this page is wrong, or that something is being stored that should have been asked about, you may take it up with the Information Commissioner's Office. You need neither our agreement nor our knowledge to do it, and nothing has to be raised with us first.
How to use it
The regulator sits at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, takes calls on 0303 123 1113, and accepts complaints at ico.org.uk/make-a-complaint. Making one costs nothing and needs no professional help.
Our duty
Questions sent to [email protected] are answered within five working days. Where your message is a formal data protection request, the deadline is one calendar month and part 6 of the privacy guide sets out exactly how that runs.