Three cookies. All of them sign-in.

All three are set by my API when you sign in, and all three are gone when you sign out. A signed-out visitor reading this page has none of them.

• bv_auth_token: the pass that proves each request is yours. It lasts fifteen minutes, goes to every part of the site, and nothing on the page can read it.
• bv_refresh_token: gets you a fresh pass when that fifteen minutes runs out, so you are not asked for your password again. It lasts thirty days, or ninety if you ticked remember me when you signed in. Your browser sends it only to my sign-in endpoints, and nothing on the page can read it either.
• bv_csrf_token: proves a request came from this site and not from another tab pretending to be you. The page reads this one and echoes it back in a header, which is the whole point of it. It lasts ninety days, so an idle browser is not logged out by it expiring first.

Blocking these means sign-in cannot work. Everything a signed out visitor can do, which is browsing and sending me a sourcing request, works with cookies switched off entirely.

These are stored by your browser, not sent to me with every request the way a cookie is. This is the whole list, and clearing site data for this domain removes every one of them.

• bv_secure_token: your sign-in pass and the moment it expires.
• bv_secure_session_active: a yes or no, so the page knows to check your session before it renders.
• bv_secure_user: your name, email and account flags, encrypted.
• bv_secure_enc_key: the key that encrypts the line above. Held in session storage, so closing the tab discards it.
• auth-storage: a second copy of your name and email, so a page can greet you before the session check comes back. This one is not encrypted.
• token and user: older copies of the same two things, still written when you sign in with a password.
• deviceFingerprint: a random value for this browser, so I can tell you which devices are signed in on your security page.
• preferredCurrency: the currency you asked prices to be shown in. Prices are charged in USD either way.
• lastKnownRate: the last exchange rate this browser saw, so prices still convert if the rate service is slow.
• pwa-first-seen, pwa-pageviews and pwa-install-dismissed: whether you have seen the prompt to install this site as an app, and whether you dismissed it.

If your browser refuses local storage, the site falls back to a short-lived cookie for the same values so that signing in still works.

I use Cloudflare Web Analytics to see which pages people read and which ones they leave. It sets no cookie, writes nothing to your browser storage, and records no identifier that links one visit to the next or one site to another. What I get is counts: pages, referrers, countries, load times.

It runs for everyone, because there is nothing about it to consent to. That is also why this site shows you no cookie banner. A banner asking permission for something that collects no personal data would be theatre, and it would be one more thing standing between you and the page you came for.

• No advertising cookies, and no ad network is loaded on this site.
• No cross-site tracking, no retargeting pixels, no social media trackers.
• No selling or sharing of anything in the lists above.
• No profile of you built from what you browse.

When you pay, the card form is Stripe’s and Stripe sets its own cookies on that page for fraud checks. That is the one place another company’s cookie appears, it only appears once you are paying, and I never see your card either way.

Every modern browser lets you block or delete cookies and site data from its settings. Signing out clears all three cookies above. Clearing site data for this domain clears everything in the storage list.

If you block all cookies, signing in and paying stop working. Browsing, reading and sending me a sourcing request all still work.

Questions about cookies or tracking: [email protected].