Two cookies. One keeps you signed in, and one protects the forms.

sid

Keeps you signed in, and carries the token that protects forms against cross-site request forgery. Set when you sign in, cleared when you sign out. It holds a random identifier and nothing about you. Marked HttpOnly, Secure and SameSite, so a script cannot read it and another site cannot send it.

ev_csrf

Protects the forms against cross-site request forgery while you are not signed in, the sign in form among them. Set when you open a page with a form on it without being signed in, and gone after a day. A page with no form, such as this one, does not set it. It holds a random value and nothing about you. Marked HttpOnly, Secure and SameSite, so a script cannot read it and another site cannot send it.

That is the complete list.

A cookie that is strictly necessary for a service you asked for does not require consent under the Privacy and Electronic Communications Regulations. Both of ours are that, and there are no others, so there is nothing to ask you about.

Consent banners exist because sites set cookies people would refuse if asked. We would rather not set those cookies than build the machinery for asking.

• No analytics of any kind. We do not know which pages you read.
• No advertising or remarketing cookies, and no advertising anywhere.
• No session recording or heatmaps.
• No social media pixels, and no share buttons that call home.
• No fonts, scripts, images or stylesheets loaded from another company's servers, on any page. The two typefaces are served from our own server, like everything else.

The app keeps your records on the phone itself, so that you can write down what you did in a field with no signal. That is storage on your own hardware rather than a cookie, it is never sent anywhere except to sync with your own account, and signing out of the app, or deleting it, removes it.

The website keeps a copy of the signed in pages you open, in your own browser, so they still show with no signal. Signing out clears them. If you are signed out somewhere else, or delete your account on another device, a browser left signed in clears them the next time it reaches us. Until then, with no signal, it can still show them.

Your unit and language preferences are held against your account rather than in a cookie, so they follow you to another device.

There is no analytics running: the switch for it is off. Even switched on, the code lets analytics run only on the public pages, never while you are signed in, and only after you say yes. Before it was switched on for anybody, this page and the privacy notice would say exactly what it sets.

The reason for the signed-in exclusion is worth spelling out: a page inside the application can show a horse's health history, its microchip number and the yard it lives at. That is not something we are willing to hand to a third party in order to find out which button is popular.