Cookie policy

1. What this site sets

Two kinds, and only one of them is set without asking you first.

• iberium_consent — necessary. It records whether you accepted or declined analytics, so that we can act on your answer and stop asking. It is set either way, including when you decline: remembering a refusal is what lets us honour it. It holds nothing but the word "granted" or "denied", is never sent to anyone else, and lasts about six months.
• _ga and _ga_6FTXLN5BJV — analytics. Set by Google Analytics, and only after you have accepted. They give your browser a random identifier so repeat visits can be recognised as the same browser. They last up to two years, and deleting them is one click — see section 3.
• ib_vid and ib_sid — analytics, and ours rather than anyone else's. Set only after you have accepted. ib_vid is a random identifier that lets us tell a repeat visit from a first one, and lasts 180 days. ib_sid groups the pages of a single visit together and expires after 30 minutes of inactivity. Both are marked HttpOnly, which means the site's own scripts cannot read them either — they are sent to us and to nobody else, and they are random identifiers rather than anything worked out about you.

Your browser also stores one item in sessionStorage: an entry created by the site's router to remember your scroll position as you move between pages. It is strictly necessary for that, holds no identifier, is never sent to us or to anyone else, and your browser clears it when you close the tab.

2. The analytics, and why we ask first

We want to know which pages people read, how long they spend on them, roughly where they arrive from, what kind of device and browser they use, and whether the enquiry form actually works. It helps us write a more useful site and notice when something is broken.

Two systems measure this at the moment: Google Analytics, and analytics we built ourselves and run on our own database in Frankfurt. We currently use both systems in parallel so we can validate the measurements produced by our own analytics against Google Analytics.

It is not used for advertising. The advertising features of Google Analytics are switched off on our property, we run no ad products, and we do not combine what it tells us with anything else to identify you.

Because it stores cookies on your device and sends information to Google, we ask before any of it loads. Until you accept, nothing is requested from Google at all — no script, no image, no connection. If you decline, that stays true and we do not ask again.

3. Changing your mind

The Cookie settings link at the foot of every page reopens the question, whichever way you answered. Turning analytics off stops any further collection from that point, deletes the Google cookies described above, and expires ours: ib_vid and ib_sid are removed when the page reloads rather than remaining until their normal expiry.

Every browser also lets you block or delete cookies and site data through its own settings. Nothing here will break if you do: the site works the same either way.

4. Who receives a request

Loading a page necessarily gives these services your IP address as part of the request:

• Vercel — hosting. Serves the pages and keeps short-lived security and performance logs. Always.
• Google — analytics, as described above. Only if you have accepted, and never before.
• Supabase — the database holding the analytics we run ourselves, in Frankfurt. Only if you have accepted. Your browser never contacts it directly: the measurements go to this site, and this site writes them to the database.

The typefaces are served from this site itself, so loading a page makes no request to any third-party font service. If you have not accepted analytics, Vercel is the only service involved.

5. Changes

Earlier versions of this page said we would ask for your consent before loading anything that was not strictly necessary. That is what this is: analytics was added, and it asks first. If we ever add anything else in that category, we will do the same and update this page before it goes live.

This page was updated when we began running our own analytics alongside Google's, and it describes what that currently records. We intend to measure which sections of a page hold attention, and where people click, in the same privacy-preserving way — none of that is running yet, and this page will be updated before any of it is.