Cookies

The one cookie

sb_session, set when you sign in with Google and removed when you sign out. It holds a random token and nothing else — not your name, not your email, nothing a person could read off it — and the server is what knows which account that token belongs to. It lasts thirty days, it is marked HttpOnly and Secure so no script can reach it and it never travels unencrypted, and it is sent to nobody but this site.

If you do not sign in, this site sets no cookie at all. That is the ordinary case: the whole catalogue is readable without an account.

Why there is still no banner

A consent banner asks permission to store something on your device that is not needed to deliver what you asked for. A session cookie is what keeps you signed in, so pressing the sign-in button is the consent, and a dialogue asking again would be asking twice. Everything a banner exists to warn about — analytics, advertising, anything read by another company — this site does not do, so there is nothing left to ask about.

No third-party script runs on any page here, so there is nothing on this site able to read a cookie, ours or anybody's.

What is kept in your browser instead

Two values in local storage, both put there by the interface for the interface, both readable only by this site, and neither sent to the server:

• sbg-theme — light or dark, so the site opens the way you left it.
• sbg-voted — which entries you have marked as replaced, so the button stays pressed instead of inviting you to press it again.

Neither identifies you and neither is used to track anything. Clearing site data in your browser removes both, and the site keeps working without them — it simply opens in dark mode and forgets which buttons you pressed.

How the site is measured, then

By the server that already answered your request, writing a row with a one-way hash of your address and browser rather than an identifier stored on your device. Nothing is written to your browser to make it work. How we count explains the method, and Privacy covers what is recorded and for how long.

If this changes

The login arrived, and this page changed with it. Anything beyond what is strictly necessary will be asked about rather than assumed, and it will be written here before it happens rather than after. Questions go through the form below. Nothing on this page is legal advice.