Cookie Notice

Last updated 2 October 2026

What is set, on every visit

This Site carries two Google tags — Analytics, and a Google Ads conversion tag — loaded by one script that runs on every page, whether or not you have an account. Between them they set three cookies in your browser, all first-party: readable by this Site and by nobody else.

_ga and _ga_WNPFPFWQ1R are the analytics pair. They hold a randomly generated identifier for the browser, not for you: no name, no email, nothing you typed. Their purpose is to tell a returning visit from a new one and to keep a single visit together as one session. Both expire two years after your last visit.

_gcl_au is the advertising one, and it is worth being plain about it: it exists so that Google can connect a click on one of our adverts to what you did after arriving here. It holds a randomly generated identifier and the time it was set, and it expires after about three months. Where audience features are switched on in our advertising account, it is also what lets this visit be counted towards a remarketing audience — which is how you end up seeing our advert again somewhere else.

None of the three is strictly necessary. The Site works identically with all of them blocked, and the next section says how to block them.

No device fingerprinting technique is used, here or anywhere on the Site.

How to refuse them

Any of these stops the analytics cookies being set, and the Site carries on working exactly as before:

Block cookies for this Site in your browser's settings — that stops all three. Or use any content blocker: both tags load from googletagmanager.com, which every blocklist already covers, so blocking it stops both at once. Or install Google's own opt-out add-on, which turns Analytics off across every site you visit, and use Google's ad settings to turn off personalised advertising across Google's products. Nothing on this Site detects, nags about, or works around a blocker.

If you sign in: one piece of strictly necessary storage

Accounts are optional. Signing in stores your session in your browser's local storage, so you stay signed in as you move between pages and when you come back, and so your lists and your feedback follow you. It is strictly necessary storage: it exists only to provide a feature you asked for, and without it signing in could not work at all.

That storage holds your authentication session and nothing else. It does not hold anything you type or attach, and it is removed when you sign out.

What the advertising cookie is, and is not, for

It is there to measure our own advertising: whether a click on an advert of ours led to anything here, and — where audience features are switched on in that account — to let Google show you our advert again elsewhere. That is the whole of it. We do not sell any of it, we do not run adverts on this Site, no other company's advertising tag is here, and nothing from your account is part of it.

What the two tags see between them is set out in section 6 of the Privacy Policy: pages opened, where you arrived from, approximate location, device and browser. Neither sees what you type into the tool matcher, the files you attach to it, or anything in your account — that code and this code have no connection to each other. The sign-in session is not used to profile you and is not shared with advertisers.

Third-party requests

Loading a page from this Site contacts one other company: Google, for the two tags described above — which between them reach googletagmanager.com, the Analytics endpoint, googleadservices.com and Google's own ad-serving domains. Everything else on the page comes from this domain: fonts are hosted here, logos are hosted here, no advert is ever shown on this Site, and no other company's tracker is on it.

Beyond that, your browser talks to someone else only in cases you choose: when you click a link to a product, when you send us a message through one of the forms, and when you use the optional account features, which connect to Supabase and — if you pick that option — to Google to sign you in. A visitor who never signs in makes no request to Supabase at all.

Where you go next

Every AI product linked from this Site runs its own cookies and tracking. Those begin the moment you click through, and are governed by that provider's policy rather than ours.