Cookies.

Draft cookie information — professional review required 3 October 2026. No advertising, analytics or third-party scripts are installed.

The service uses two first-party security cookies: session — random sign-in token; the database stores its SHA-256 digest; expires after eight hours. HttpOnly and SameSite=Strict, with Secure enabled for configured HTTPS installations. Logout deletes the browser cookie and server session. csrf — random pre-login form security token; expires after eight hours. HttpOnly, SameSite=Strict and Secure under HTTPS. A separate server session CSRF token is used after sign-in; form submissions must also have the exact configured Origin.

These are intended for essential authentication and request-forgery protection, with no tracking purpose. Their strictly necessary classification and final explanation require review for the real service. No optional-cookie consent banner is implemented because there are no optional cookies. If analytics, advertisements or other storage are introduced, assess the current PECR Schedule A1 exceptions and their conditions, and implement consent or required information/objection controls before loading them. Online advertising is not treated as exempt. The review uses the ICO storage/access guidance finalised 29 April 2026, rather than its older cookies summary: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/ . Current revised law: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6 and https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1 .

You may delete cookies or configure your browser to reject them, but sign-in and protected forms will stop working. The site loads its styling from this server; it uses no remote fonts, pixels, localStorage or fingerprinting. Review actual hosting/provider additions, not just this application, before launch.