Legal
Cookies and local storage
Last updated September 9, 2026
This site sets one cookie of its own, keeps one item in your browser's local storage, and — while you are signed in — sets the session cookies that keep you signed in. All of them are strictly necessary for the site to work. There are no advertising, analytics, measurement, or session-replay cookies here, no tag manager, and no third-party script of any kind.
What we set, and why
A cookie on this site does one of two things: it remembers that you completed the researcher gate, so you are not asked again on every page, or, while you are signed in, it keeps your session. Local storage holds your order between page loads.
The one cookie we set ourselves contains no identifier we can trace back to you, and neither does local storage. A session cookie does identify your account — that is what a session is — and it lasts from sign-in until you sign out or it expires. None of them is read by anyone but this site. Nothing on this site profiles you, follows you to another site, or measures what you looked at.
The full list
This is the complete inventory. If you find something in your browser from this site that is not on this list, we want to hear about it.
- al_researcher_verified — cookie, first-party, 30 days, SameSite=Lax. Records that you affirmed the two researcher statements at the gate. Its value is the single character 1.
- al_cart_v1 — local storage, not a cookie, kept until you clear it. Holds the items in your order. It is never sent to us with a request; it leaves your device only when you submit an order.
- Session cookies set by our authentication provider — set when you sign in, removed when you sign out. If you never sign out they persist so that you are not asked to sign in again, for up to roughly thirteen months on the provider's default settings. They are what keeps you signed in from one page to the next.
- A short-lived sign-in cookie holding a one-time code verifier — set when a sign-in that round-trips away from this site starts (an emailed link, or a provider sign-in), used once when it completes, then cleared. It exists so the completion can be tied to the browser that started it.
Why there is no cookie banner
Consent rules exist for cookies that are not strictly necessary: advertising, analytics, measurement, personalisation. We set none of those, so there is nothing here to ask you to consent to, and an interstitial asking permission we do not need would be theatre.
al_researcher_verified is set by this site's own code running in your browser, which means scripts on this site can read it. That is a consequence of how it is set, not a route to anything about you — it holds the character 1. The session cookies are the opposite case: they are set by the server and marked httpOnly, so no script on the page can read them at all.
You do not have to take our word for any of this. View the page source, or open the network panel in your browser and reload. Every request goes to this site, until you choose to pay and are sent to the payment processor's own site.
Clearing them, and what happens if you do
You can clear or block all of it in your browser settings, at any time, without asking us. Nothing here resists it and nothing is restored behind your back.
If you clear al_researcher_verified you will see the researcher gate again on your next visit. If you clear local storage your saved order is emptied — and because it never left your device, there is no copy of it for us to restore.