Cookies

Name bss_member, written by the account page after a successful sign in.

• What it holds: your display name, cleaned of anything that is not plain text, and nothing else.
• What it is for: greeting you by name on the home page without that page having to ask the server who you are, on a page whose job is a hero card.
• How long: 30 days, then it expires by itself. Signing out clears it immediately.
• Where: this site only, and it is marked SameSite Lax so it does not travel with a request another site starts.

It is never consulted to decide whether somebody is signed in. The real session is the one described below, which the site checks on every request. Forging this cookie by hand buys you a wrong name in a greeting on your own screen.

Two things, both in your browser's local storage:

• The visitor mark, va.counted. The first time a page opens in your browser, the page asks the site for a one time code and sends it straight back, the site adds one to that day's number of visitors, and the page writes this mark so your browser is never counted again. It holds the single character 1 and nothing else, and it never leaves your device. With Do Not Track switched on, nothing is sent and no mark is written.
• Your session, bss.member.session, written when you sign in or make an account. A random token, with your name and email address beside it so the account page can show whose it is. It is what keeps you signed in between visits, and it is only ever sent to this site, to prove it is you. The site ends it after thirty days without use or six months in all, and signing out removes it.

The committee console keeps its own working list only for as long as its tab is open, and never writes it to disk, because that list is everybody else's names rather than the reader's own.

Consent is what a site needs before storing something on your device for its own purposes, above all for advertising or for following you between sites. This site does neither.

The cookie and the session exist to run a member account that you asked for by creating one, and storage that is strictly necessary for a service the user requested does not need a banner. The visitor mark holds no identifier, is never sent anywhere, and has one job, which is to stop the site counting you twice. Putting a banner in front of every visitor to ask about a greeting and a tally would be theatre.

If that ever changes, a banner will appear before the thing it is asking about loads, and refusing will be one click and will work.

There is no Google Analytics on this site, no Meta pixel, no TikTok pixel, no heatmap and no session recorder.

The site counts its own visitors and nothing else: how many people opened it each day, kept by the site itself. No page address or referrer is sent, and no network address or identifier is kept. Nothing on any page can follow you to another website.

Nothing. Every typeface, script, stylesheet and image is served from this site's own address, and so are the account system and the visitor count. The account and committee pages carry a policy that refuses anything else.

There is no embedded video, no social widget and no typeface fetched from a font service anywhere on the site: the two faces are served from here.

Your browser's Clear browsing data control removes the cookie, the session and the visitor mark, after which your next visit is counted once more. Signing out removes the cookie and the session on its own.

A private window keeps none of it between sessions. A content blocker may stop the visitor count, and the site works exactly the same without it.