Cookie Policy
Last updated: August 2026
First-party cookies we set
access_token — httpOnly, Secure, SameSite session cookie carrying a signed token that authenticates your portal requests; expires after 30 minutes and is silently refreshed while you are active. refresh_token — httpOnly, Secure cookie used solely to obtain new access tokens; expires after 7 days, or 30 days if you tick "Remember me". Both are inaccessible to JavaScript, are never used for tracking, and are deleted on sign-out.
Third-party cookies & storage
Google Firebase Authentication stores authentication state in your browser's IndexedDB/localStorage to keep your Firebase session alive between visits (governed by Google's Privacy Policy). Stripe sets its own cookies on checkout.stripe.com during payment for fraud prevention and session integrity (governed by Stripe's Cookie Policy). Cloud infrastructure in front of our site may set a transient bot-protection cookie (e.g., __cf_bm) that expires within 30 minutes. We set no analytics, advertising, or social-media cookies.
Aggregate visit counting (no cookie)
So we can see roughly how many people visit the site, we count total visits in aggregate — this does not use a cookie or any browser storage. Each visit is checked against a same-day, one-way cryptographic hash of your IP address and browser type so a single visit isn't counted twice; that hash cannot be reversed back to your IP or browser, is never linked to any account, profile, or individual, and is automatically deleted within a few days. We learn how many visits happened, never who made them. Visits detected as coming from a VPN, proxy, or Tor exit node are excluded from the count where that's detectable.
Why no consent banner?
Regulations such as the ePrivacy Directive require consent for non-essential cookies. Because every cookie we set is strictly necessary for authentication, security, or payment — and our aggregate visit count uses no cookie or storage at all — no consent banner is required — using the site is not conditioned on accepting any tracking.
How long storage lasts
access_token: 30 minutes. refresh_token: 7–30 days. Firebase auth state: until you sign out or clear site data. Stripe checkout cookies: set and governed by Stripe, typically expiring within the session or up to one year for fraud-prevention identifiers. Aggregate visit-count dedup hash: a few days, then automatically deleted.
Managing & deleting cookies
You can view, block, or delete cookies in your browser settings (Settings → Privacy → Cookies in most browsers), and clear Firebase auth state via "Clear site data". Blocking or deleting our essential cookies will sign you out and prevent portal features from working; the public website remains fully readable without any cookies. There is no cookie to block for the aggregate visit count — it isn't stored on your device at all.
Do Not Track & GPC
We set no tracking cookies and build no visitor profiles, so there is no persistent, individual identifier for Do Not Track or Global Privacy Control to switch off. Our aggregate visit count doesn't store anything that identifies you individually or your browser beyond the same calendar day, so honoring DNT/GPC wouldn't change what we retain.
Changes
If we ever introduce a new category of cookie or a more identifying form of analytics, we will update this policy first and, where consent is legally required, ask for it before setting anything.