A plain-English summary of what we set in your browser, why, and how to change your mind.
Three categories
- Necessary. Sign-in session, CSRF protection, the consent record itself. Always on. Without these the site doesn't function.
- Analytics. A first-party visitor cookie (
flare_vid, 1 year) so we can count unique visitors. Page views, country (derived from IP), the IP itself truncated to a coarse network prefix, browser / OS / device class, time on page, plus campaign attribution fromutm_*query parameters on the URL that brought you in. Self-hosted. No third-party tracker is loaded. - Marketing. Same as analytics, plus the originating IP address (full, not truncated) on the page-view row and a keyed SHA-256 hash of the IP (HMAC) on the visitor record, retained for 90 days. Used for measuring paid acquisition; not sold or shared.
What we never collect
- Form contents, POST bodies, or anything you type beyond what you submit.
- Fingerprinting (canvas, WebGL, font lists, screen dimensions beyond device class).
- Cross-site identifiers. There are no third-party trackers loaded on this site.
- Full request URLs beyond the path and any
utm_*query params.
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| sessionid | Sign-in session | 2 weeks |
| csrftoken | CSRF protection | 1 year |
| flare_consent | Your consent choices | 1 year |
| flare_vid | Anonymous visitor ID for analytics | 1 year |
Your controls
Use the to change your choices any time. Your browser's "Do Not Track" header is honored. If it's on, we treat you as having refused analytics + marketing regardless of cookie state.
For a full data export of everything we hold about your account, see Settings → Account → Export my data.