Legal
Cookie policy
Not legal advice — needs your input before publication
A cookie policy has to describe the cookies the site actually sets, and this site has not been built yet. The structure below is right; the specifics have to be measured on the finished site. Each gap is marked, and two of them are decisions worth making before the build rather than after.
What cookies are
A cookie is a small file a website asks your browser to keep. Some are needed for the site to work at all — staying logged in, remembering what is in a basket. Others exist to count visitors or to make advertising follow people around. They are not the same thing and this page keeps them separate.
What this site uses
The honest position is that this cannot be written accurately until the new site is built, because the cookies a site sets depend on what is installed on it.
Needed — a cookie audit, after the build
Every cookie the finished site sets, with its name, who sets it, what it does and how long it lasts. This has to be measured on the built site rather than predicted: analytics, embedded video, any form handler and any login system each add their own, and a list that does not match what the browser actually stores is worse than no list. Run the audit once the stack is chosen and the site is assembled.
Video from Vimeo
The video library is hosted on Vimeo and played through an embedded player. When a video loads, Vimeo may set its own cookies, which are outside our control and covered by Vimeo's own policy.
Decision, not just wording
Whether embedded players load on page load or only after the visitor clicks play changes what has to be disclosed and consented to. Loading them only on click ("click to play" placeholders) means no third-party cookie is set unless somebody asks for the video — which is both better for privacy and faster. Worth deciding during the build rather than retrofitting.
Analytics
If we measure how the site is used, it is to find out which pages are useful, not to build a profile of you.
Needed
Which analytics tool the new site will use, if any. A cookieless option (Plausible, Fathom) avoids a consent banner altogether for this purpose; Google Analytics does not. This choice determines whether the site needs a consent banner at all, so make it before the build rather than after.
How to control them
Every browser lets you see the cookies a site has set, delete them, and block them in future. Blocking all cookies will break parts of most websites, including anything that needs you to stay logged in.
Needed
Whether the site shows a consent banner and, if so, what it does when someone declines. A banner whose "reject" button does not actually prevent the cookies is a common and serious compliance failure — worse than having no banner.
Changes
If the cookies the site uses change, this page changes with them and the date at the top is updated.
Contact
Questions about cookies, or about anything else we do with data, can go through the contact page. How we handle personal data more generally is covered in the privacy policy.