Cookies and Analytics

Last updated: 9 September 2026.

Necessary functions

The website uses the `bp_session` cookie for signed-in access. It contains an opaque random token, is HttpOnly and SameSite=Lax, and is Secure on the live site. It expires no later than the verified sign-in token and within one hour. The server stores a hash of the token rather than the cookie value. The private-preview gate, while enabled, uses browser-managed HTTP Basic authentication rather than a separate app cookie.

Supabase uses browser storage for Google’s PKCE sign-in flow and the temporary provider session. For this project the storage prefix is `sb-edryhxatzziqartpvcal-auth-token`, including a temporary code-verifier entry during redirects. The app clears the provider session after successfully exchanging it for its own cookie; an interrupted sign-in can leave temporary data until it is cleared or the browser removes it. This storage supports sign-in and is not an advertising identifier.

During Google sign-in, `bp_adult_confirmation` temporarily stores “yes” in the browser’s tab-session storage so your adult confirmation survives the redirect. It is removed after a successful session exchange; otherwise it follows the browser’s tab-session lifecycle. It contains no date of birth or identity-document information.

Cloudflare Turnstile loads on protected community forms and processes device and connection information to check for automated abuse. Pre-clearance is disabled for this widget. See the Turnstile Privacy Addendum. Blocking necessary storage or security scripts can prevent sign-in or protected forms from working.

The necessary `bp_return_to` session-storage entry remembers the case or administrator page you were opening during Google sign-in. It contains only a local page path and is removed after successful sign-in or when the browser tab is closed.

Case-page counts

A case’s view total estimates full case-page opens; marker previews do not count. The server hashes a secret, UTC day, connection IP and a limited browser user-agent string to suppress rapid repeat opens for 30 minutes. Raw IP and user-agent strings are not stored in the site database for this count. The resulting pseudonymous signals are normally removed within 25 hours by hourly cleanup. This uses no persistent browser cookie or cross-site profile. A hash is not a guarantee of anonymity. See the Privacy Notice for the lawful basis, limitations and your right to object.

Optional Google Analytics

With your permission, Google Analytics measures visits to public pages, including the Coming soon homepage. It receives cookie identifiers, the public page path, visit/session information, approximate location and browser/device information. Google processes connection information to provide this service. We do not send account IDs, emails, submission text, search terms, URL query strings or fragments. The tag is disabled on sign-in, account, submission and admin pages, in private previews and during signed-in sessions. Automatic enhanced measurement of searches, forms, outbound clicks and similar interactions is switched off. Advertising storage, advertising personalisation and Google signals are disabled by this website’s tag.

The Google tag does not load before you choose Accept analytics. Reject analytics leaves the site fully usable. Cookie settings in the footer lets you change your choice or withdraw consent. Do Not Track and Global Privacy Control keep analytics off. We use consent for optional analytics; withdrawing it stops future collection through this site and clears accessible Analytics cookies, but does not undo earlier lawful processing.

The browser preference is stored as `bp_google_analytics_v1`, including the choice, wording version and decision/expiry times, for 180 days. This is necessary to remember your choice and is not sent as a visitor identifier. The older `bp_optional_analytics` preference was for Cloudflare and does not grant Google consent. Analytics uses `_ga` and `_ga_095D0CZ0GJ` first-party cookies to distinguish visits/sessions, configured to expire after 180 days without extending the original expiry on each visit. Browser restrictions or clearing storage may shorten those periods. Clearing the preference causes the site to ask again.

Google’s property settings retain event-level data for two months and user-level data for 14 months, with the user-level period reset by new activity. These controls do not set the retention period of most aggregated reports. Google can process data outside the UK, including in the United States, under the applicable data processing terms and transfer safeguards. See Google Analytics data collection, data retention and Google’s Privacy Policy. Contact 1britspov@gmail.com about analytics privacy or removal requests.

External services and control

YouTube playlists, videos and X posts open as external links in release one, rather than automatically loading players or social feeds into a case page. The destination may use its own cookies and data practices when you choose to visit it. A sign-in provider or Turnstile may load when you request an account or protected action; read the Privacy Notice for those services.

Browser settings let you inspect or clear site storage. Clearing storage may also clear a saved privacy preference. Where consent is used, refusing or withdrawing optional consent must be as straightforward as accepting it, and must not stop ordinary case browsing. Contact 1britspov@gmail.com for help or a privacy concern.

YouTube activity panels

The YouTube API feed is disabled. Following a playlist or video link opens YouTube, where its own privacy settings apply. Reading this site’s pages does not automatically load a YouTube player, tracking script or cookie.