Cookies

What we use

Two analytics cookies, and only if you say yes. Google Analytics uses a pair of cookies to tell one visit from the next. Neither is set until you accept them on the banner, and declining means they are never written at all. Signing in stores one token, which is not a cookie and is described further down.

Both are set by our own domain, carry no name or email, and are read only by Google Analytics. What Google receives is described in the Privacy policy.

Before you answer

Nothing is requested from Google until you accept. Most sites load the analytics tag on every page and merely tell it not to store anything until you agree. We do not, because loading it is itself the disclosure: any request to any server carries your IP address, so a tag that loads before you have answered has already told Google you were here. Google Fonts were moved onto our own domain for that exact reason, and it would be incoherent to do the opposite one page over.

So the tag is fetched at the moment you press Accept, and never otherwise. Decline and your browser does not contact googletagmanager.com at all. The cost of doing it this way is ours: we can only count people who accepted, and everyone else is invisible to us rather than counted anonymously.

Stored in your browser, but not a cookie

Signing in stores sb-<project>-auth-token in local storage, not in a cookie. The difference matters if you are trying to get rid of it: clearing cookies will not touch it, and blocking cookies will not stop it being written. It is removed when you sign out, or by clearing site data for stackkit.site in your browser settings.

Your answer to the cookie banner is kept the same way, under sk-consent. A cookie recording that you refused cookies would be a poor joke, and clearing your cookies would wipe the refusal and make us ask again.

Requests to other companies

If you accepted, the analytics tag is fetched from Google and reports your page views to it. If you did not, that request never happens. Either way, video in the feed is hosted by Cloudinary, which sets no cookie but receives your IP address when a video loads, because that is what making a request involves. Fonts used to work this way too, and are now served from our own domain.

What we do not use

No advertising cookies, no cross-site trackers, no advertising pixels, and no social embeds that watch you. Short clips in the feed are played from a file rather than an embedded player, so no player sets anything on our behalf.

Videos you choose to play

Some featured videos belong to creators on YouTube, Vimeo or Loom. Nothing is loaded from those services while you browse. Only when you press play on one of them do we open that service's own player, and from that moment it may store its own data in your browser and receive your IP address, under its own privacy policy. We use YouTube's privacy-enhanced youtube-nocookie.com player, which does not set cookies until you interact with the video. If you would rather none of that happened, simply do not press play.

Changing your mind

Whatever you picked, you can pick again. This reopens the banner:

Cookie settings

Switching from yes to no expires the two cookies there and then, rather than merely telling Google to stop adding to them. You can also do it by hand: clear them in your browser's site settings for stackkit.site, block them there, or use any tracker blocker — Google also publishes an opt-out add-on at tools.google.com/dlpage/gaoptout. Nothing on the site stops working without them; we simply stop counting you.

The sign-in token is a different matter: it is the session. Clearing it means you can read the site but are no longer signed in, so saving tools and replying will not work until you sign in again.

Server-side records

Separately from cookies, we log page requests at our CDN — including IP address — for up to 30 days. That is described in the Privacy policy. It does not involve storing anything in your browser and cannot be refused with cookie settings.

Questions: [email protected]