Legal · Cookies
Every cookie here is ours. None of them follows you anywhere.
This site sets two cookies. One keeps your scope check answers together from one screen to the next; the other stops a form being posted by a page pretending to be this one. There is no third.
Draft · not published
Every cookie here is set by this site.
Read from the configuration that sets them, not written from memory. Both expire on the same clock, because the second is issued alongside the first.
| Name | What it does | How long it lasts | How it is set |
|---|---|---|---|
XSRF-TOKEN |
Carries the token that proves a form you send came from this site, and not from a page pretending to be it. It holds a token and nothing else — no name, no address, no identifier that follows you. | 2 hours |
|
shippeu-session |
Holds the identifier that keeps your scope check answers together from one screen to the next. Your answers stay on the server; this cookie only says which set of them is yours. | 2 hours |
|
The session cookie takes its name from the application, so it reads differently on a development machine than in production. What stays the same is what it holds: an identifier, and nothing else.
We run no analytics, no pixel and no third-party font.
No analytics. No advertising pixel. No embedded video, no map, no chat widget, no social button — and no font loaded from someone else’s domain, which is the third-party request most sites forget they make.
The three typefaces this site uses are downloaded when the site is built and served from this domain, alongside the stylesheets. That is a deliberate choice and it is why this page can be this short.
You do not have to take our word for it. Open your browser’s network panel and reload this page: every request it lists stays on this domain, and the response headers show the two cookies above and nothing else.
We ask for no consent today, and here is why.
Neither of these cookies measures you. Neither is read by anyone but this site, neither follows you to another one, and neither exists if you never open a page.
A banner that asks permission for cookies that do not need it teaches people to click through the ones that do. So this site does not show one — and whether it may go on not showing one is a legal reading, not a writer’s decision:
To be completedwhether a consent banner is required here, and its wording if it is
Your browser can refuse them, and something breaks.
Your browser can refuse both, and this site does not try to talk you out of it. Reading these pages works either way. Here is exactly what stops working:
XSRF-TOKEN- The scope check stops accepting your answers. The server has no way left to tell your submission apart from a forged one, so it refuses both.
shippeu-session- The scope check forgets what you answered on the screen before, and you start again on every question.
Deleting them later costs you nothing beyond a scope check in progress. Nothing is stored in your browser that we cannot rebuild.
The day we add a tracker, this page changes first.
This list is not maintained by hand, which is why it can be trusted. A test compares it to the cookies a real response actually sets, and it fails when the two disagree — so a third cookie cannot appear without this page changing in the same commit.
If we ever add something that measures you, it will be named here, with what it does and how long it lasts, before it is switched on. That is the order, and the test is what makes the order hold.