What cookies are
Cookies are small files stored by a browser. Related technologies can include local storage, pixels, and scripts that recognize a browser or device.
Current site behavior
The starter pages are static HTML, CSS, and JavaScript and do not intentionally set analytics or advertising cookies. The web host may use essential technologies for delivery, security, or abuse prevention. Check the deployed site and hosting configuration to confirm.
External content
If the site later embeds maps, videos, social posts, analytics, or other third-party services, those providers may set cookies or collect usage data under their own policies. Avoid adding such embeds without reviewing their behavior and disclosures.
Your controls
Most browsers let you block, delete, or limit cookies. Blocking essential technologies may affect site functionality or security. If consent is legally required for a new technology, configure a suitable consent mechanism before activating it.
Updates
Revise this policy whenever the site’s technologies change and provide an effective date. This page is informational and is not a substitute for a technical cookie audit.
Effective date: October 20, 2026. This page was last updated October 20, 2026.
Technology inventory
The operator should maintain a practical inventory of each cookie and similar technology that is active on the production site. The inventory should identify the technology or provider, its purpose, whether it is first-party or third-party, its lifetime, and whether it is essential or optional. A technology should not remain active merely because it was added during development. The inventory is a way to compare actual browser behavior with this policy and any consent interface, rather than a claim that every listed category is currently deployed.
Session technologies
Session cookies may support a temporary interaction, such as moving through a form or maintaining a security state. They generally expire when the session ends, although browser behavior can vary. If a session cookie is required to provide a visitor-requested feature or protect the service, it should be limited to that function. Session data should not be repurposed for advertising or unrelated profiling without a separate legal assessment and any required consent.
Local storage
Local storage can retain a setting after a browser session closes. A site might use it to remember a contrast preference or a visitor’s choice about a cookie banner. It is controlled by the browser and may be cleared by the user. The site should avoid placing secrets or unnecessary personal details in local storage because scripts running on the same origin may be able to read it. A local preference is typically device-specific and should not be represented as a universal account setting.
Consent and choice
Where consent is required for optional storage or access, the choice should be made before the technology is activated. A consent interface should explain categories in understandable language and offer a genuine way to reject optional categories. Consent should not be inferred from continued browsing, preselected optional toggles, or an obscured control. A visitor should be able to revisit the choice and withdraw it. Necessary functions should remain available when a visitor rejects optional analytics or advertising technologies, unless a particular optional feature genuinely depends on them.
California signals
California privacy law may treat identifiers and browsing activity collected through cookies as personal information in some circumstances. When the operator is subject to applicable opt-out requirements, it should provide the required method for opting out of sale or sharing and honor recognized opt-out preference signals where mandated. A cookie banner alone may not satisfy every California disclosure or opt-out duty. The website should avoid using analytics or advertising scripts in ways that contradict its privacy disclosures or the choices a visitor has made.
International consent rules
Under European and UK rules that apply, device storage and access may be subject to ePrivacy or related consent requirements, while personal data processing may separately be governed by GDPR. Necessary exceptions are narrow and depend on the purpose. Consent should be granular when different purposes are involved, easy to refuse, and easy to withdraw. Similar requirements may exist in other countries. The operator should assess where visitors are located and which providers are used before deciding whether a consent banner, regional control, or other mechanism is needed.
Third-party embeds
Embedded maps, videos, social posts, fonts, or other external content can cause a browser to contact another provider and may allow that provider to set or read technologies. Such content may not load until a visitor chooses to activate it where consent is required. A link that opens an external service in a new page is different from an embed that loads provider scripts in the current page. The operator should identify third-party requests during testing and describe their role accurately rather than assuming that all tracking is visible from the page’s text.
Browser controls
Most browsers let users block cookies, clear stored data, or restrict third-party cookies. These controls may affect page features and may not communicate a legally recognized preference to every provider. Deleting stored consent information can cause the site to ask again. Private browsing may clear session information when the window closes. Visitors can consult their browser’s help for the exact controls available, and may use the website’s own preference interface when present.
Security and lifetime
A cookie should not contain sensitive content. Relevant cookies should use suitable security attributes, including Secure when transmitted over HTTPS, HttpOnly when not needed by client scripts, and SameSite settings appropriate to the workflow. The lifetime should be no longer than needed. Persistent identifiers deserve particular scrutiny because they can enable recognition over time. The operator should review expiration settings and remove obsolete technologies when a provider or feature is discontinued.
Changes and inquiries
A new analytics provider, advertising system, membership tool, or embedded service may change the technologies used. The operator should update this policy and consent controls before or when the change takes effect as required by law. Visitors may contact the operator through the published site contact channel with questions about a specific browser behavior. Please identify the page and technology if known, but do not include passwords or confidential credentials. This policy describes intended governance and should be kept aligned with production testing.
How to evaluate each technology
Before adding a cookie, script, pixel, or embedded widget, the operator should identify the feature it supports and whether the feature can work without it. The review should record the technology name, provider, data accessed, storage location, duration, and whether information is sent to another organization. A provider's marketing label is not enough to determine whether a technology is essential or analytics-related. The actual browser behavior should be tested, including requests made before a visitor selects a preference. If the technology is optional and consent is required, it should remain inactive until a valid choice is recorded. If a provider changes its behavior or terms, the inventory and consent design should be reviewed again.
Consent records and withdrawal
Where consent is the legal basis for optional storage or access, the site should be able to demonstrate the choice at a level appropriate to its scale and risk. A preference record may contain the selected categories, time of choice, and a limited identifier used to remember the setting. It should not become a broad tracking profile. Visitors should be able to reopen settings, reject optional categories, and withdraw a prior choice. Withdrawal should stop future optional access or storage as soon as reasonably possible; it may not erase information already lawfully processed or records that must be retained for compliance. The choice interface should use plain language and should not obscure the reject option or make refusal materially harder than acceptance.
Embedded content and social features
A page may display content hosted by a video, map, photo, or social platform. Loading an embedded player or widget can cause the provider to receive network information and set its own identifiers, even if the visitor does not actively press play or follow a link. Where practical, the site should use a privacy-preserving preview or click-to-load design so the visitor can choose whether to contact the external provider. The provider's terms, privacy policy, and controls apply to its processing. A simple outbound link usually behaves differently from an embedded script, so the site should distinguish these implementations instead of describing every external link as a cookie.
Cookie lifetimes and cleanup
A session cookie normally supports a temporary browser session, while a persistent cookie remains until its expiration or deletion. The site should avoid long-lived identifiers when a short-lived setting is enough. When a feature is retired, associated cookies and scripts should be removed from the page and the inventory updated. A visitor's browser may retain an old cookie until it expires or is cleared, so the operator should not promise immediate removal from every device. Cookies used for authentication or security must be configured carefully and should not contain readable secrets. Local storage and other browser storage should be reviewed alongside cookies because a cookie banner alone does not control all storage mechanisms.
Testing and transparency
A practical cookie review should use a clean browser profile and inspect network and storage behavior before and after a choice. It should confirm that rejecting optional technologies does not prevent access to ordinary public pages or the guestbook unless a specific feature genuinely depends on the technology. The review should also test that the saved preference survives a normal visit, that the settings link works, and that a new optional provider triggers an updated choice when necessary. Visitors should be told what is actually active, not a generic list of tools that are merely possible. If the website currently uses only necessary technologies, the policy should say so accurately and should not imply that analytics or advertising trackers are installed.
Preference interface and equal choice
A preference interface should present meaningful options in language visitors can understand. Accepting all optional technologies should not be the only prominent action while refusal is hidden in a secondary screen. Where category-level choices are appropriate, the visitor should be able to select only the categories they want, and the interface should explain the effect of each choice. The site should avoid preselected optional categories where the law requires an affirmative choice. A preference should be honored across pages that use the same consent system, and the site should not repeatedly ask after every navigation unless a legitimate change or technical limitation requires it. Consent is not valid merely because a visitor continues browsing when the site has failed to provide a required choice.
Do not place personal data in storage
Cookies and browser storage should not be used to store a guestbook message, private contact content, password, payment details, or other sensitive data in a readable form. A preference token should contain only what is needed to remember a setting and should not expose a person's identity. If an application needs to associate a session with server-side data, the browser token should be random and the sensitive record should remain on the server with appropriate access controls. The operator should avoid putting personal information in query strings because URLs can be copied, recorded in logs, or shared through referrers. These practices reduce accidental exposure and make it easier to explain the site's storage behavior accurately.
Troubleshooting a stored preference
If a visitor reports that a cookie choice is not being remembered, the site may need to check whether the browser blocks storage, whether the preference script is loading, or whether the website's domain or protocol changed. Moving from one hostname to another can create a separate browser storage context, so a prior preference may not carry over. Clearing browser data can also remove the record. The operator should not ask a visitor to disable all security protections as a first step. A useful response is to explain how to open the site's preference control, how to clear only relevant site data if desired, and how to report the browser and page where the issue occurs. A preference failure should not be used to activate optional tracking without consent.