Why there is no cookie banner

Because we do not set anything that needs one. Under the UK rules, a site only has to ask permission for cookies that are not strictly necessary, which in practice means advertising and analytics cookies. We set neither. The way we count visits, below, uses no cookies.

We would rather explain that once, here, than interrupt a parent with a pop up before they have read a word.

The three cookies

Name	What it does	How long
pw_access	Keeps you signed in as you move between pages. Your browser cannot read it, only send it back to us.	A few minutes, then it is replaced
pw_refresh	Gets you a fresh session without making you type your password again. Single use: if the same one is ever presented twice we treat it as theft and sign that account out everywhere.	Until you sign out
pw_csrf	Stops another website submitting a form to us while you are signed in. This is the one cookie the page itself needs to read, so it is not hidden from the browser.	Until you sign out

All three are marked Secure and SameSite=Lax, so they only travel over an encrypted connection and are not sent when another site links to us.

Counting visits without cookies

To see which of our public pages people find useful, we count visits to them with Cloudflare Web Analytics. It sets no cookies, keeps nothing on your device, does not build a profile of you, and does not follow you to other websites. We see totals: how many visits a page had, which site sent them, and roughly which country they came from.

It only runs on our public pages, like this one, the home page and the guides. It never runs inside the app once you are signed in, and never on a child's shared passport.

Not a cookie, but worth saying

Your light or dark theme choice is kept in your browser's local storage, not in a cookie. It never reaches our servers. Clearing your browser data resets it.

Cloudflare sits in front of the site to keep it up and block attacks. On an ordinary visit it sets no cookies. If it ever needs to check that a visitor is a real person rather than a bot, it may set a short lived security cookie to remember the answer. That is part of protecting the service rather than anything we use to learn about you.

Turning them off

You can block or delete cookies in your browser settings. If you block ours, signing in will not work, because staying signed in is the entire job they do. Nothing else on the site depends on them.

The privacy notice covers everything else we hold, and the terms cover the rest of the arrangement.