Why there is no cookie banner

Because we do not set anything that needs one. Under the UK rules, a site only has to ask permission for cookies that are not strictly necessary, which in practice means advertising and analytics. We run neither.

We would rather explain that once, here, than interrupt a parent with a pop up before they have read a word.

The three cookies

Name	What it does	How long
pw_access	Keeps you signed in as you move between pages. Your browser cannot read it, only send it back to us.	A few minutes, then it is replaced
pw_refresh	Gets you a fresh session without making you type your password again. Single use: if the same one is ever presented twice we treat it as theft and sign that account out everywhere.	Until you sign out
pw_csrf	Stops another website submitting a form to us while you are signed in. This is the one cookie the page itself needs to read, so it is not hidden from the browser.	Until you sign out

All three are marked Secure and SameSite=Lax, so they only travel over an encrypted connection and are not sent when another site links to us.

Not a cookie, but worth saying

Your light or dark theme choice is kept in your browser's local storage, not in a cookie. It never reaches our servers. Clearing your browser data resets it.

Cloudflare sits in front of the site to keep it up and block attacks, and it may set its own security cookie to tell a real visitor from a bot. That is part of protecting the service rather than anything we use to learn about you. [confirm whether Cloudflare Bot Management cookies are enabled]

Turning them off

You can block or delete cookies in your browser settings. If you block ours, signing in will not work, because staying signed in is the entire job they do. Nothing else on the site depends on them.

The privacy notice covers everything else we hold, and the terms cover the rest of the arrangement.