Cookie policy

This is a short policy because this is a site that sets very few cookies. We do not run advertising trackers, we do not embed social media pixels, and nothing here follows you around the internet afterwards. The complete list is further down, and the scanner beside it reads your own browser so you can check that the list is telling the truth.

Cookie policy

What counts as a cookie here

A cookie is a short piece of text a site asks your browser to keep and hand back on the next request. Browsers have two other stores that do a similar job, local storage and session storage, and the UK rules that cover cookies cover those as well. This page treats all three the same way, and the list below says which is which for every entry.

A handful of things here write a cookie, one writes to session storage, and nothing at all writes to local storage. Rather than give you a number to take on trust, the list below names every one of them with what it holds and how long it lasts, and the scanner underneath it reads your own browser and checks the list against what is actually there.

The categories, and which need your consent

Strictly necessary: required to deliver the site you asked for. Under the Privacy and Electronic Communications Regulations these do not require consent, because without them the thing you asked for does not work. Blocking them for this site stops the contact form submitting.

Preferences: they remember a choice you made and nothing else. There is one, it holds five numbers describing where you put the assistant panel, and deleting it only means the panel opens at its default size.

Analytics: one, and it is off until you turn it on. Google Analytics is the only thing on this site that asks permission. Until you accept the banner, no request leaves your browser for Google, no script of theirs is loaded, and neither analytics cookie below is set. Saying no is a real no rather than a preference we record and ignore, and you can change your answer either way, as often as you like, from the panel further down this page.

Marketing: none. There is no advertising pixel, no social pixel, no remarketing tag and no conversion tracker anywhere on this site, and nothing here follows you to another one.

Third-party content

Almost none, and what there is has a job. No map, video, comment system, chat widget, social button, font host, tag manager or advertising network is embedded on any page of this site. The typefaces are served from this domain rather than from a font network, which is the usual way a site leaks a request to somebody else without meaning to.

There are two exceptions, and they behave differently enough to be worth separating. The first is Cloudflare Turnstile, the check at the bottom of our enquiry form. It loads from Cloudflare on the pages that carry that form, and only those, because it is the thing that tells a person filling the form in apart from the software that fills in every form it can find. We turned it on after the form collected several dozen automated submissions in its first months. It replaces the older sort of test that made you read wavy letters or pick out traffic lights, and most of the time it asks you for nothing at all.

Turnstile is not in the list below, and this is why: what it stores it stores against Cloudflare's own address rather than ours, which puts it outside both this domain and the reach of the scanner further down the page. We are not in a position to read it, so listing it there would suggest a precision we do not have. Cloudflare states that it is used to run the check and not to build a profile of you or to follow you to other sites, and their privacy policy is the authority on it. It is loaded without asking because it protects a form you have chosen to fill in, which is the narrow security case the regulations exempt, and it appears nowhere else on the site.

The second is Google Analytics, and it is not embedded in the pages we serve at all. The page arrives with no reference to Google in it; the script is fetched by your browser only after you have turned analytics on, and never otherwise. For anyone who has said no, ignored the banner or blocked scripts, there is nothing of Google here to describe.

The assistant sends your question to Anthropic to be answered, and that is a request made by our server rather than by your browser, so it sets nothing on your machine. What we send and what we keep is covered in the privacy policy.

Controlling what is stored

Every major browser lets you view, block and delete cookies and browser storage through its settings, and lets you do it for one site rather than all of them. Blocking the strictly necessary entries for this site will stop the contact form working. Blocking everything else will not affect your reading of the site at all.

The preferences cookie can also be cleared on its own, from the same browser settings. Nothing on this site has to be told about it and nothing behaves differently afterwards except the size the assistant panel opens at.

If the scanner finds something that is not on the list

Then either this page is out of date or something has been added to the site that should not have been, and both are worth knowing about. Tell us what it was called and which page you were on, and we will either add it here with an explanation or take it off the site.

A browser extension can also write to a page you are reading, and the scanner cannot tell the difference between that and something the site did. It is worth checking in a private window before you conclude it was us.

Everything this site stores in your browser

This is the whole list. Underneath it, the scanner reads your browser and checks it entry by entry, and flags anything it finds that we have not declared here.

Cookies and browser storage used by this site
Name Kept as Category What it holds How long
setweb-session Cookie Strictly necessary Identifies your visit while you are on the site, so that a form you submit is recognised as coming from the page you filled in. Set: On every page you open. Marked HttpOnly, so no script on this page can read it, including the scanner below. Until you close the browser, or two hours idle
XSRF-TOKEN Cookie Strictly necessary A cross-site request forgery token. It is what stops a form on this site being submitted from somewhere else in your name. Set: On every page you open. Until you close the browser, or two hours idle
setweb_assistant Cookie Preferences Five numbers: the width and height of the assistant panel, where on screen you put it, and whether you left it open. No identifier, nothing about who you are, and none of what you asked it. Set: Only once you open, move or resize the assistant panel. Six months
setweb_assistant_chat Session storage Strictly necessary The conversation you are currently having with the assistant, so that following a link to another page does not throw it away. It stays in the tab and is never attached to a request, so it reaches neither our server nor our logs. Set: Only once you send the assistant a message. Until you close the tab
setweb_assistant_greeting Session storage Strictly necessary One word, recording that the assistant has already said hello in this tab, so that it says it once rather than on every page you open. It holds nothing else. Set: Once the assistant has offered to help, whether or not you answer it. Until you close the tab
setweb_consent Cookie Strictly necessary Which way you answered the analytics banner. One word, granted or denied, and nothing else. It is the record of your choice rather than a tracker, which is why it is set whichever way you answer and why it is exempt from needing consent of its own. Set: Only once you answer the analytics banner, either way. Twelve months, then we ask again
_ga Cookie Analytics Google Analytics uses it to tell one browser from another, so that four pages read in one visit are counted as one visit rather than four. It holds a random identifier and nothing we can tie back to you by name. Set: Only after you turn analytics on. Nothing is set if you say no, ignore the banner, or never see it. Two years
_ga_9FFFXEJ0GH Cookie Analytics The second half of the pair above: it holds the state of your current visit for this specific property, which is what lets Google Analytics work out when a visit started and when it ended. Set: Only after you turn analytics on. Nothing is set if you say no, ignore the banner, or never see it. Two years

Analytics: your choice

Google Analytics is the only thing on this site that asks permission, and it is off until it is given. While it is off, no request leaves your browser for Google and the two analytics rows above are not set. You can switch it either way here, as often as you like.

Changing this needs JavaScript, which appears to be switched off. Nothing loads from Google while it is, so analytics is already off for you.

Scan this browser

This reads the cookies and browser storage this site can see on your machine and checks them against the table above. It runs in your browser and stops there: no result is sent anywhere, nothing is logged, and we never see it. The scanner itself stores nothing, which is why it is not on the list it is printing.

The scan needs JavaScript, which appears to be switched off. The table above is the full declared list and does not depend on it.