About

Cookie Notice

Last updated

I build and run this site on my own, as an individual and not a company. This page describes how the site is meant to work and is kept accurate on a best-effort basis, but software has bugs, and the site may not always behave exactly as described. The Terms of Use explain what that means for you. First-person pronouns on these pages (I, me, my) refer to me, Ben Lambert.

Cookies are small pieces of text that a website asks your browser to keep and send back on later visits. This site uses cookies only to keep you signed in and to remember one preference. It does not use cookies for analytics, advertising, or tracking, and it is designed to set nothing until you sign in, create an account, open an email verification link, change that preference, or choose to load reCAPTCHA.

Cookies this site sets

To the best of my knowledge, these are all the cookies the site's own code sets:

  • apisession keeps you signed in to the site's API. It is set when you sign in, create an account, verify your email address, or change your username, password, or optional email choices, and lasts 7 days from the last time it was set, or until you log out. Opening an email verification link sets it on the browser where you open the link, even if you were not signed in there.
  • bffsession keeps you signed in to the site itself and tells it who you are. It is set and expires at the same times as apisession.
  • animationsPaused remembers whether you have paused the site's animations. It is set when you use the pause or play control, and lasts 400 days after you last use it.

The two session cookies each hold a token containing your account details: your account ID, name, email address, and username, when the account was created and last changed, whether your email address is verified, whether it is an administrator account, whether it has been suspended, and your current answers to the consent checkboxes, with the date and time you gave each one. The token is signed so that it cannot be altered, but it is not encrypted. The cookies are marked so that only the site's server can read them, not scripts running in the page, and they are sent only over HTTPS. Logging out or deleting your account deletes both from the browser you do it on. Session cookies in other browsers are not deleted, and last until you log out there or they expire. The animation preference cookie holds the word true or false and nothing else.

Cookies set by Google reCAPTCHA

The create account, forgot password, and request new verification link pages include Google reCAPTCHA, which protects the site's forms from automated programs. Google's script loads only after you choose to load reCAPTCHA on one of those pages. It then sets its own cookie, _GRECAPTCHA, on Google's domain, for its risk analysis, and it may also keep information in your browser's local and session storage. Once loaded, Google's script keeps running until you reload the page, close the tab, or leave the site. Moving to another page of this site does not stop it by itself. The site asks again before showing reCAPTCHA on another form. This site does not read that cookie or that storage. Google describes the cookie in its reCAPTCHA questions and answers. The Privacy Notice explains what else reCAPTCHA collects and how Google may use it.

Controlling cookies

You can delete or block cookies in your browser's settings; each browser's help pages explain how. If you block the session cookies you will not be able to stay signed in, and if you block the preference cookie, animations will play on each visit. The site's own code does not use local storage or any other way of keeping information in your browser; only reCAPTCHA, once you choose to load it, may.