Policy
Cookies and local storage
Draft · 2026-10-23
Draft for review. This page is verified against the deployed site: no first-party cookies, no analytics or advertising storage. Re-verify whenever hosting, analytics or sponsorship changes.
The public site sets no first-party cookies and stores nothing in your browser. There is therefore no consent banner: a banner asking permission for cookies that do not exist would be theatre, and would train readers to click through the one that matters later.
What is set today
| Name | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
__cf_bm | Cloudflare (hosting) | Bot management and abuse protection; may appear on some requests | Up to 30 minutes | Strictly necessary / security |
_cfuvid | Cloudflare (hosting) | Rate limiting for requests originating from a shared address | Session | Strictly necessary / security |
These are set by the infrastructure that serves the pages, not by eDossier code. They carry no reader identity and are not used for advertising or cross-site tracking.
What is not used
- No analytics product on the public site (Cloudflare's optional Web Analytics injection is blocked by our content-security policy).
- No advertising or social pixels, including inside sponsor cards: sponsorship is a label and an outbound link, not a tracker.
- No localStorage, no sessionStorage, no fingerprinting on public pages.
If that changes
Optional cookies will only be introduced with a prior consent gate offering accept, reject and granular choice on equal footing; no optional storage or third-party request before a choice; a persistent choice; and a reopenable preferences link in the footer. Rejecting will be as easy as accepting, and rejection must not degrade access to dossiers.
Controlling cookies yourself
Your browser can block or delete these cookies; the site does not depend on them for reading. Blocking Cloudflare's security cookies may cause more frequent bot challenges.
Editorial and admin surfaces
The editorial workspace is a separate hostname and is not public. When it launches it will use a session cookie, documented there and here, scoped to that hostname only.