Cookie Policy

1.The cookies we set

Your session cookie, tih_token. Set when you sign in, and it is what keeps you signed in. It holds a signed token identifying your account. It cannot be read by JavaScript, it is sent over HTTPS, it is not sent on cross-site form posts or background requests from other sites, and it lasts 7 days or until you sign out.

Two short-lived sign-in cookies, tih_oauth_state_<provider> and tih_oauth_verifier_<provider>. They are set only when you start a Google or X sign-in, and they exist to prove that the sign-in coming back from the provider is the one you started — without them, someone else could finish a sign-in in your browser. They last 10 minutes and are cleared as soon as the sign-in completes.

That is the complete list.

2.What we do not set

• No advertising or retargeting cookies.
• No cross-site or third-party tracking cookies.
• No Google Analytics, Meta pixel, Hotjar, Segment or similar — none of these are loaded by the site at all.
• No session recording or heatmap tools.

3.Error and performance monitoring

The product can be switched into first-party error and performance monitoring (Microsoft Application Insights) so we can find crashes and slow pages. That tool sets its own first-party cookies to group a visit's events together. It is not switched on for the public site today, and if that changes, its cookies will be listed on this page before it is turned on.

4.Controlling them

Signing out removes the session cookie. Your browser can clear or block cookies for this site at any time, and blocking them does not cost you anything except the ability to sign in — the sign-in cookie is the mechanism, so without it there is no signed-in session to have.

Because every cookie we set is strictly necessary to deliver a service you asked for, there is no consent banner. Whether that stays correct is one of the things going to the legal review, and it stops being correct the moment anything on this page changes.