Legal and compliance
Cookie Policy
Every cookie this site sets, what it does and how long it lasts. There is no analytics and no third-party cookie.
The short version
This site sets five cookies and no others. Every one of them is strictly necessary: four to sign you in and keep that session safe, and one to remember that you have read this page. There is no analytics cookie, no advertising cookie and no third-party cookie of any kind.
Under the Privacy and Electronic Communications Regulations, strictly necessary cookies do not require consent. That is why the banner on this site has one button rather than two: refusing a session cookie would mean refusing to sign in, and a button pretending otherwise would be dishonest.
Every cookie, in full
| Name | Purpose | Lifetime |
|---|---|---|
| htr_session | Holds your session token so you stay signed in between pages. The token is stored on the server as a hash, so the database does not contain anything that could be used to sign in as you. | 14 days |
| htr_csrf | Protects every form on this site against cross-site request forgery — the attack where another website submits a form to this one on your behalf. | Matches the session; 12 hours if you are not signed in |
| htr_flow | Ties a one-time sign-in code to the browser that asked for it, so a code intercepted in transit cannot be used elsewhere. Cleared as soon as you sign in. | 30 minutes |
| htr_flash | Carries a single confirmation message across a redirect — "Settings saved", and the like. Deleted the moment it is shown. | 2 minutes |
| htr_cookie_notice | Records that you have seen the cookie notice, so it is not shown again. It stores a version number and nothing else. | 12 months |
How they are set
Every one of them is:
- HttpOnly — no script can read them, including ours. This site's only script never touches a cookie at all.
- SameSite=Lax — not sent when another site makes a cross-site request.
- Secure and prefixed __Host- when the site is served over HTTPS, which pins each cookie to this exact origin and path.
- First-party. Nothing on this site issues a cookie for another domain, and no other domain is contacted to render a page.
Local storage and similar
None. This site does not use local storage, session storage, IndexedDB, web beacons, device fingerprinting or any other technique for storing or reading information on your device.
Third-party content
There is none. Fonts, stylesheets, scripts and images are all served from this domain, and the content security policy on every page forbids the browser from loading anything from anywhere else. That is not only a privacy measure — it means a compromise of somebody else's content delivery network cannot reach the people using this service.
Turning them off
You can clear or block cookies in your browser's settings. Blocking the four session cookies means you will not be able to sign in — there is no way round that, because the session is the cookie. Blocking only htr_cookie_notice is harmless; you will simply see the notice again on each visit.
If this changes
The notice carries a version number. If a cookie is ever added that is not strictly necessary, that version changes, everybody is asked again, and the notice will offer a genuine choice — accept or decline — rather than a single acknowledgement. Nothing non-essential will be set before that choice is made.
Contact
Questions about this document go to contact@infin8.digital.
A registered address has not been published on this installation.