Cookie Policy

Short version

This site sets only strictly-necessary cookies — session, CSRF, and your language preference. Under the ePrivacy Directive those need no consent, which is why there is no cookie banner to click. We removed Google Analytics in September 2026; nothing has replaced the cookies it used to set.

The cookies we set

Name	Purpose	Lifetime	Necessary?
`sessionid`	Keeps you logged in. Set by Django when you sign in to the forum.	Session (cleared when you log out or close your browser).	Yes — required for logged-in features.
`csrftoken`	Cross-site request forgery token. Protects against malicious sites tricking your browser into making requests on your behalf.	1 year	Yes — required for any form submission (login, registration, posting).
`django_language`	Remembers the interface language you selected via the language switcher.	1 year	Optional in theory — the site falls back to your browser's Accept-Language header if it's missing. Contains no advertising or tracking data.

That is the complete list of cookies. Two things also live in your browser's own storage, where they stay — they are never sent to us and are not used to recognise you: the browser start page remembers which search engine you picked (mv-engine-url), and the staff admin remembers a light/dark preference (theme). Clearing site data removes both. Nothing else is stored in localStorage, sessionStorage or IndexedDB.

We do want to know which pages get read. That is counted on this server: when a page loads, a small script reports the path and the referring site, we derive a country from your IP address using a database held locally and then discard the address, and the result is added to a daily total. No identifier is created on your device, nothing is read from it, and no third party is involved — so there is nothing here for a cookie to do.

Whether two page loads came from the same visitor is worked out server-side from a value salted with a random number that is destroyed after two days. That makes yesterday's visitors unlinkable to today's, and it is the reason this site can report how many people came without being able to say who came back.

If you send a DNT or Sec-GPC header, nothing is counted at all. See the Privacy Policy for the full description.

What we do NOT set

No analytics cookies — there is no analytics script that would want one.
No advertising cookies (we don't run ads).
No social-media cookies (Facebook Pixel, Twitter/X, etc.).
No third-party content delivery network (CDN) tracking cookies.
No fingerprinting techniques as a substitute for cookies.

Cookies from embedded content

We do not currently embed any third-party widgets that would set their own cookies (no YouTube embeds, no Twitter timelines, no Facebook Like buttons). If we ever do, this page will be updated and a per-widget consent prompt will appear next to the embedded content ("Click to load YouTube" pattern).

Anti-spam (Cloudflare Turnstile)

Registration and contact-form submissions are protected by Cloudflare Turnstile, a privacy-respecting CAPTCHA alternative. Turnstile does NOT use tracking cookies — it analyses the request itself (e.g., browser fingerprint heuristics) to determine if it is human, in a way that doesn't follow you across the web. See Cloudflare's documentation for technical details.

How to opt out

Send a DNT: 1 or Sec-GPC: 1 header — every major browser has a setting for one or both — and no visit of yours is counted.
Block /api/px in a content blocker, or browse with JavaScript off. Both work; nothing on the site depends on the beacon.
The strictly-necessary cookies are required for logged-in features; to avoid them, browse logged-out or use private/incognito mode.
Delete your account if you no longer want to participate.

Questions

If anything here is unclear, email meshhold@gmail.com.

Questions about this document? Email meshhold@gmail.com.