Cookies

The one thing you choose

Most cookie pages exist to let you decline analytics and advertising. There is no advertising here at all. Analytics is Google Analytics, loaded through Google Tag Manager, and Microsoft Clarity, which shows where people click and scroll with all text and pictures masked. Both sit behind the single switch on this site: the banner asks on a first visit, the button at the foot of this page reopens the answer, and until you allow it Google’s tags write nothing to your browser and send cookieless pings at most, and Clarity does not load.

Signed out, with analytics refused or unanswered, this site sets no cookies at all — unless you enter the password of a shared link, which sets the one below.

The two that exist

Both are set by our authentication provider, are first-party, and are marked HttpOnly and Secure — script on the page cannot read them:

• __Secure-neon-auth.session_token — keeps you signed in. Without it, every page load would ask you to sign in again. It goes when you sign out.
• __Secure-neon-auth.session_challenge — exists for the ten minutes of a sign-in round trip, so the reply from Google can be matched to the request that started it. It is what stops somebody else’s sign-in landing in your session.

One for a link with a password

tp_unlock_ followed by a code for the link — set when you enter the password of a shared link, so the next page load does not ask again. It is first-party and HttpOnly, and lasts a day. It holds a signature that proves the password was entered, never the password itself, and a new password on the link makes it worthless.

Set only if you allow analytics

Google Analytics and Microsoft Clarity set these, and only after you allow analytics. Refusing later stops them; clearing site data in your browser removes them.

• _ga and _ga_3WW403TWDN — Google Analytics, so a later visit is recognised as the same browser. Up to two years.
• _clck — Microsoft Clarity, the same for Clarity. Up to a year.
• _clsk — Microsoft Clarity, joins the pages of one visit into one recording. A day.
• MUID — set by Microsoft on its own domain, clarity.ms, not on this site. Up to a year.

Browser storage, which is not a cookie

Two things live in your browser’s local storage and are never sent anywhere: the theme you picked, and — when you are signed out — your recent conversions, so the history has something in it. Clearing site data in your browser removes both, and the app carries on without them.

Counting, which needs neither

Visits and a few actions are counted on our own server as anonymous daily totals. That sets no cookie and stores nothing in your browser, so there is nothing here to allow or refuse — the privacy page says exactly what is counted.

If that changes

Anything optional gets a real control before it is set, not after — that is what the banner and the button below are. The date above says when this last changed.