Gather & Roll
Sign in
Cookies

What we store on your device.

Your choices
Always on
Necessary. Signing you in, keeping you signed in, and the token that stops someone else's site submitting forms as you. There's no version of the app without these, so they aren't offered as a choice.
Analytics Google Analytics, counting which pages get used so we know what to improve. Off unless you turn it on. Google's advertising features are disabled, so nothing here feeds ad targeting.

You haven't answered yet, which counts as a no: nothing optional is running.

The cookies themselves

Session. Identifies your browser to the app so it knows you're signed in. Deleted when it expires or when you sign out.

CSRF token. Proves a form submission came from a page we served. Security, not tracking.

"Remember me". Only if you tick that box on the sign-in page. It's what keeps you signed in after the session cookie has gone.

Cookie choices. This page's answer. Slightly circular, but the alternative is asking you the same question on every visit.

Analytics. Only if you turn it on above. Google Analytics then sets two: _ga, a random number that lets it tell one browser from another without knowing who you are, and _ga_ plus a code for this site, which tracks the current visit. They last two years, and turning analytics back off expires them.

Not a cookie, but stored on your device

Your light-or-dark preference lives in your browser's local storage, not on our servers and not in a cookie. It never leaves the device and identifies nobody.

Where the analytics data goes

Google Analytics is Google's, which means that if you accept it, the pages you visit here are sent to Google and stored on their servers, including outside the UK and EU. We've said no to their advertising features — Google Signals and ad personalisation are both switched off — so the data isn't used to build advertising audiences or joined to your Google profile across other sites. That's a setting we chose, and it's the reason the sentence about advertisers on this page is a true one.

If that trade isn't one you want to make, "Only necessary" is a complete answer and the app works exactly the same.

What we don't do

No advertising cookies, no cross-site profiles, and nothing sold to anyone. Analytics is the only third party involved, and only with your yes. If you sign in with Discord or Google, that happens on their site and they set their own cookies there — the privacy page covers what comes back to us.

Changing your mind

Come back to this page — it's linked in the footer of every page — and save a different answer. It takes effect immediately.