Cookie Policy

What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to store. Related technologies, such as local storage and session storage, also keep information on your device.

Some storage is strictly necessary to provide something you have asked for, such as protecting a form, or to remember a privacy choice you have already made. Other storage — analytics, advertising, tracking — is not necessary, and under UK rules requires your consent before it is set.

This page describes what ekstruh.dev actually uses. It is an operational notice, not a claim that the arrangement has been certified by a regulator.

What this website uses

Most of ekstruh.dev is made of static pages. Those pages do not set the contact session cookie, and they store nothing until you make a privacy choice.

The contact page is different. Because it accepts a form submission, it needs to tell one visitor apart from another for security purposes, and that requires a session cookie. It is set when the contact page loads, it is first-party, and it is used only for the protections described below. The privacy controls cannot switch it off: without it the form cannot complete its security checks.

After you choose Accept optional cookies or Reject optional cookies, a separate preference cookie is stored so the notice does not have to be shown on every page. That cookie is also first-party and strictly necessary. It is not set before you choose, and continued browsing or scrolling is not treated as a choice.

Cookies we set

The matching data for ekstruh_session on the server is temporary and is cleared by the server’s own session housekeeping.

That session cookie holds nothing but a random session identifier. Your name, email address, enquiry type and message are not stored in it, and they are not stored in the corresponding server-side session either. The session holds only the security token and the timing counters used to prevent repeated automated submissions.

ekstruh_consent holds three pieces of information only: a version number, the word accept or reject, and the time of the choice. It is written by the website’s own script after you press a button. The current version grants no optional category.

Both cookies are first-party. They are sent only to ekstruh.dev with ordinary requests. They are not used to recognise you across other websites, and the site code does not build a profile from them.

Security attributes

ekstruh_session is set with conservative attributes, which this change does not alter:

• HttpOnly — it cannot be read by JavaScript;
• SameSite=Lax — it is not sent on cross-site requests from other websites;
• Secure — over HTTPS, so it is only ever sent on an encrypted connection;
• Path=/ and no fixed expiry, so it is a session cookie rather than a persistent identifier.

ekstruh_consent uses Path=/, SameSite=Lax, a 182-day lifetime, and Secure when the page is served over HTTPS. It is not HttpOnly, because the same first-party script has to read it in order to remember your choice and keep optional technologies off. It is not a user identifier.

How your choice is stored and changed

A notice appears until a valid choice is stored. It offers three actions, all on the first screen: reject optional cookies, accept optional cookies, or manage preferences. Reject is not hidden behind another step. Closing the preferences panel, scrolling, or continuing to browse does not count as acceptance.

Manage preferences opens a panel. The only category in use is Strictly necessary, marked always active, because that is the only storage this website deploys. Analytics and marketing are not listed as switches: those technologies are not present, and a switch for a tool that does not exist would be misleading.

Accepting and rejecting currently have the same technical result. No optional script, pixel or storage is loaded either way, because none is deployed. The stored choice still matters: it records what you asked for, and a later optional technology will not treat an older acceptance as permission to start. You would be asked again.

Cookie Preferences, in the footer next to Cookie Policy, reopens the panel on any page. You can accept, reject or change that decision there without clearing browser data yourself. Rejecting after an earlier acceptance updates the record immediately and removes any first-party optional cookie this website had created. None are created today.

Without JavaScript the notice cannot store a choice. The rest of the website still works, including the contact form, and no optional technology runs, because none is included in the pages. You can still read this policy and use your browser’s own cookie controls.

The preference is kept for 182 days, then the notice is shown again. A damaged or unrecognised value is ignored and treated as no choice.

If the browser rejects the preference cookie, the same accept or reject value is kept in session storage for the current tab so the notice can close. That copy is not an identifier and is not used for analytics. It is discarded when the tab ends. If that storage is blocked as well, the notice closes on this page and is shown again on the next page.

What we do not use

As at the date at the top of this page, ekstruh.dev does not use:

• analytics of any kind, including Google Analytics, Microsoft Clarity, Hotjar or self-hosted equivalents;
• tag managers;
• advertising, remarketing or conversion pixels;
• behavioural tracking or cross-site tracking;
• social media plugins, share buttons or embedded feeds;
• embedded third-party video or maps;
• externally hosted fonts, scripts or stylesheets;
• localStorage;
• user accounts, advertising identifiers or analytics identifiers.

Every page on this website loads scripts, styles and images only from ekstruh.dev. No other organisation sets a cookie through this site. A link to another website, such as the ICO, is only followed if you choose to open it.

Controlling cookies in your browser

Browsers let you see the cookies a site has set, delete them, and block cookies generally or for particular sites. Those controls are in your browser’s settings, usually under privacy or site data. We have deliberately not written step-by-step instructions here, because browser menus change and stale instructions are worse than none.

You can block or delete ekstruh_session. If you do, the contact form will not be able to complete its security checks and your submission will be rejected. Everything else on the website will work normally, and you can always email us instead at info@ekstruh.dev.

You can block or delete ekstruh_consent. If you do, the privacy notice is shown again once any tab-only session copy of that choice is also gone. Any optional technology — none today — stays off until you choose. The footer link Cookie Preferences is the control we provide; the browser control is yours as well.

See also our Privacy Policy for how we handle the information you send us.

Changes to this policy

We will update this page if what the website stores on your device changes. The date at the top shows the last substantive update; it is not changed automatically when the site is rebuilt.

If analytics, advertising or any other non-essential storage is introduced, this policy and the preference panel must be updated before that technology is switched on. It must not run on the back of an earlier choice that did not name it.