Cookies and external services

Administrator sign-in

Supabase authentication uses first-party cookies with names beginning with sb- to maintain administrator sessions. A session may be split across several cookies. These cookies support restricted sign-in and are not used for advertising. The current authentication library sets a maximum cookie lifetime of up to 400 days and can renew or remove cookies as the session changes. Cookie lifetime does not guarantee that a login token remains valid.

Security checks

Cloudflare Turnstile checks browser and device signals to help protect forms from automated abuse. Cloudflare may also use security cookies when its configured challenge features require them; a clearance cookie is not guaranteed to be present on every visit. Cloudflare’s Turnstile Privacy Addendum explains this processing.

Performance measurement

The hosting configuration injects a Cloudflare browser performance script. Our current site security policy blocks it from running. Cloudflare describes this measurement as cookieless, without local-storage identifiers or fingerprinting. When enabled, it measures visits and page performance; it is separate from administrator authentication and form security. See Cloudflare Web Analytics for details.

Videos and links

The protected administrator video library uses YouTube’s privacy-enhanced embed domain. Choosing Load video connects your browser to YouTube, which has its own privacy practices. Privacy-enhanced mode does not mean that no information is processed. Public visitors are not shown this protected library. Opening a video link in an email takes you to the external video service.

Your choices

Closing an announcement saves its identity and dismissal time in this tab’s session storage for up to 24 hours. A changed announcement appears again. This functional preference does not track you across visits or websites.

You can manage cookies and site storage in your browser. Blocking or clearing authentication cookies can prevent administrator sign-in; blocking security resources can prevent form verification. This website does not include advertising pixels or a public social-login feature. We do not currently present an accept/reject banner for optional tracking cookies. If services change, their storage and consent needs must be reviewed before they are enabled.

For information about records and requests, read the Privacy policy or use Privacy requests.