Cookie Policy
Last updated:
1. No banner, and why
You have probably noticed that this site does not show a cookie consent banner. That is not an oversight. It is because we do not set any cookie that would require one: no analytics, no advertising, no cross-site identifiers, no third-party embeds that set cookies of their own.
A banner that says "we only use essential cookies" trains people to click Accept without reading, which makes the banners that matter useless. So we removed the reason for the banner instead.
2. What we do set
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| Session cookie | First-party, strictly necessary | Keeps you signed in and ties your session to the server-side session record | Session, or up to 30 days if you tick "remember me" |
| CSRF token cookie | First-party, strictly necessary | Prevents cross-site request forgery on sign-in and account forms | Session |
| Locale preference | First-party, functional | Remembers your interface language so you are not redirected to the default each visit | 1 year |
All three are first-party, all are set by us, and none of them are shared with anyone. None is used to build a profile of your browsing.
The extension itself sets no cookies at all. It uses the browser's extension storage API, which is not accessible to websites and is not a cookie.
3. What we deliberately do not use
- Analytics cookies or scripts. There is no Google Analytics, no Plausible, no self-hosted visitor tracker on this site.
- Advertising cookies and pixels. We do not run ads, and we do not allow anyone to retarget our visitors.
- Social media embeds. No embedded timelines or like buttons, which would let those platforms set cookies here.
- Third-party fonts or CDNs. Fonts are served from this domain, so loading a page does not tell another company that you visited.
The practical consequence is that we have very little idea how many people visit this site. We accept that trade. Server logs (below) tell us enough to keep the service running.
4. Server logs
Our hosting provider records standard request logs: IP address, timestamp, requested path, referrer, and user agent. These are used for security, abuse prevention, and capacity planning, and are retained for a short period (typically 30 days).
Logs are not used for advertising, are not joined to your account, and are not sold.
5. If you block everything
Feel free. With all cookies blocked, this website still works for browsing, documentation, the preset gallery, and the changelog.
Two things will not work without the strictly necessary cookies:
- signing in (there is nowhere to keep your session);
- submitting account-related forms (the CSRF cookie is part of the protection).
6. Contact
Questions about this notice: use the contact address at the bottom of this page. If you believe we have set a cookie we have not described here, please tell us — that would be a bug, and we would treat it as one.