Cookies Policy

This site sets one cookie of its own, and its job is to keep you signed in. Cloudflare, which sits in front of the site to protect it, may set one or two more for security. That is the lot. There are no advertising cookies, no social media pixels and no tracking of any kind.

I do count page views and a handful of actions, using analytics software I run on my own hardware. It is cookieless - it puts nothing on your device and holds nothing that identifies you.

Because every cookie described here is strictly necessary - signing in, and keeping bots out - the law does not require me to ask your permission for them, which is why you are not greeted by a consent banner. Nothing on this page is used to profile you or to follow you to other websites.

A cookie is a small text file a website asks your browser to keep and to send back on later visits. It is how a site remembers something between one page and the next - typically that you are signed in. Without one, every click would look like a stranger arriving, and you would have to type your password again on each page.

unl_session

Keeps you signed in. Set when you sign in, and cleared when you sign out. It expires 30 days after you last used the site, and its life is renewed each time you load a page, so an account you use regularly stays signed in.

It is first-party and strictly necessary, and it is set only for people with an account - browsing the flavour catalogue signed out puts nothing on your device at all.

The cookie is HttpOnly (unreadable by scripts in the page), SameSite=Lax and, on the live site, sent only over HTTPS. It holds a random token and nothing else - not your username, not your email address, not what you have tracked. The token is matched against a session record on my server, where only a hash of it is stored.

Signing out, signing out everywhere, or changing your password ends that session on the server as well as clearing the cookie, so a copy of it is no use to anyone afterwards.

None. Everything you tick off is saved to your account on the server, so it is there on your phone as well as your laptop. The site stores nothing in your browser’s local storage.

This site uses Umami, a privacy-focused analytics tool that I run on my own hardware rather than handing your visit to an analytics company.

Umami is cookieless. It stores nothing on your device, sets no identifier, records no personal information and cannot follow you to other websites. It counts page views and keeps rough aggregates - which pages are read, which site a visit arrived from, roughly which country and what sort of device, and how quickly pages loaded for you. There is no consent banner because there is nothing on your device to consent to.

It also counts a handful of actions, so I can tell whether the tracker is being used rather than just looked at: ticking a flavour off, unticking it, giving one a rating, and copying or sharing a profile link. These are bare counts. They do not record which flavour, or whose tick - what you have tracked lives in my database, attached to your account, and the Privacy Policy covers that.

Two things are deliberately stripped out before anything leaves your browser:

• Confirmation and password-reset links. These carry a one-time code in the address, and that code is the credential. It is replaced with [redacted], so the visit is counted but the code never reaches the analytics database.
• Usernames in profile addresses. A visit to /u/someone is recorded only as /u/[username]. I can see how much profile-reading goes on; I cannot see whose profile, or who read it.

Analytics is also switched off entirely in the admin area, so my own pottering about does not end up in the figures.

If I ever add something that genuinely does track you - advertising or third-party analytics - I will ask for your consent first, and you will be able to say no.

The site runs on a machine at my house, and the domain is proxied through Cloudflare so that my home broadband address is not published in DNS and so the constant automated scanning that any public site attracts is absorbed before it reaches me. Your browser therefore connects to Cloudflare, which passes the request on to me.

That means Cloudflare can set cookies of its own on this domain. Which ones depends on what it decides about a request, but the ones to expect are:

__cf_bm

Tells automated traffic apart from real browsers. It holds no personal information and cannot be read across sites; it expires after about 30 minutes.

cf_clearance

Set only if you are shown a security check and pass it, so that you are not asked again on the next page.

These are Cloudflare’s standard security cookies, not analytics or advertising, and Cloudflare does not use them to build a profile of you or to follow you to other sites. They are strictly necessary for keeping the site up, which is why they do not need a consent banner either. Cloudflare acts as my processor, and what it does with the traffic is covered in the Privacy Policy.

Nothing else on this site comes from another company: fonts and can photographs are served from this domain rather than a CDN, and the only script loaded from elsewhere is the Umami one described above, from analytics.jdg.one - a separate domain, but one I own, on the same machine. That domain is proxied through Cloudflare too, so the same security cookie can be set against it.

Every browser lets you view, block and delete cookies and site data, usually under Privacy or Site settings. Because every cookie here is strictly necessary, blocking them does not turn off any tracking - it simply means you cannot stay signed in, and the site will send you back to the sign-in page on every click. Blocking Cloudflare’s may get you shown a security check more often.

Blocking the analytics script instead - with a content blocker, or your browser’s own - costs you nothing. The site works exactly the same; the visit is simply not counted.

Guidance for each browser is on aboutcookies.org.

For everything else I do with personal information, see the Privacy Policy. Any questions about this page can go to [email protected].