What we set, and nothing loads until you interact

• fdb4-session — the session cookie. It keeps you signed in and holds the state a form needs between two requests. Expires when the session does; there is no advertising or profiling attached to it.
• XSRF-TOKEN — the CSRF token. It stops a form on somebody else's site from posting as you.

These two are strictly necessary, so there is no way to switch them off and still use the site. Cloudflare sits in front of the site and may set its own security and bot-filtering cookies; those are Cloudflare's, not ours, and we read nothing from them.

cookie_consent — remembers your choice, and nothing else. It holds one word, granted or denied, for one year, and a copy is kept in your browser's local storage so the banner does not come back if the cookie is lost. It is not an identifier: it says nothing about who you are and is never sent anywhere but this site.

_ga and _ga_* — Google Analytics. They count visits and show which pages get used, so effort goes where people actually are. They last up to 2 years and are set with anonymised IP addresses.

They are set only if you press OK on the banner. If you press "No thanks", or ignore the banner, the Google script is never fetched and no analytics cookie is ever written.

Even after you accept, nothing loads until you interact with the page — the tag is fetched on your first click, key press, scroll or touch, never on the page load itself. There is no advertising, no remarketing and no tracking of you across other sites.

Press the button below: it deletes the consent cookie and its local-storage copy and reloads the page, so the banner comes back and you can choose again. Analytics cookies already in your browser are Google's to expire; clear them from your browser's site-data settings if you want them gone today.

What is stored about an account — and what is not — is on the privacy page.