The one cookie
When you follow a sign-in link we set a cookie called ac_s. It holds a random identifier
and a signature, and what we keep at our end is a hash of that identifier rather than the value
itself. It is how the site knows which account is yours on the next page.
It lasts 30 days from the moment you sign in, and then you sign in again. It is marked
HttpOnly, so JavaScript cannot read it; Secure, so it only travels over
HTTPS; and
SameSite=Lax, so another website cannot make your browser send it. Signing out deletes it
and revokes the session behind it.
A cookie that is strictly necessary to provide a service you have asked for does not need your consent under the Privacy and Electronic Communications Regulations, and a sign-in cookie on a page you have signed in to is the textbook example. If you block it you can still read every figure, every guide and the calendar; you just cannot sign in.
No analytics cookie, because no analytics yet
We count nothing at the moment. The content security policy allows for Cloudflare Web Analytics, because that is what we intend to use, but it is not switched on.
When it is, nothing on this page will need to change. Cloudflare Web Analytics does not use cookies or any other store on your device: it reports aggregate page counts and does not build a profile of you. We will say so here on the day it goes live, and if we ever wanted something that did store data on your device, we would ask you first — that is what a cookie banner is for, and we would rather not need one.
Cloudflare’s own security cookie
Cloudflare hosts this site and may set a short-lived cookie of its own, such as
__cf_bm, to tell a person from a bot and keep the site up. It is not used to track you
across the web. The security check on the sign-in and join forms, Cloudflare Turnstile, runs only when
you are using one of those forms, and anything it puts on your device is used for that check alone.
Both are strictly necessary, so neither needs your consent either.
What this site does not do
- no advertising, so no advertising cookie and no pixel from anybody
- no social media buttons, embeds or share widgets
- no session replay, no heatmaps and no A/B testing script
- no third-party fonts, so your browser asks nobody else for anything as the page loads
- no cross-site tracking of any kind, and nothing to sell to anyone who does it
Payment is the one place you leave this site: the checkout and the billing portal are Stripe’s own pages, and Stripe sets its own cookies there under its privacy policy. That is also why we never see your card.
Controlling cookies
Your browser settings will block or delete any of this. Blocking everything leaves the public parts of the site working exactly as they do now and stops you signing in, since the sign-in cookie is the sign-in.
Anything unclear here, or a cookie you have found that is not on this page: enquiries@assizedata.co.uk. We answer in two working days, and if you have found one we have missed we will fix the page and say that we have.