Cookies
This site sets cookies only where they are strictly necessary to run the service, and none at all for advertising, analytics or tracking. There is no cookie banner because there is nothing to consent to: strictly necessary cookies do not require consent.
Browsing the public pages of this site sets no cookies at all. These pages load nothing from anyone else — no third-party fonts, no embedded video, no tag manager, no analytics script — so no other organisation is contacted by your browser and nothing is stored.
The two cookies that exist, in full
This table is wider than a phone screen — swipe it sideways to read every column.
| Name | What it is for | When it is set | How long it lasts |
|---|---|---|---|
authjs.session-token | Keeps you signed in as you move around your account. It holds a random reference to your session and nothing else — no name, no email address, nothing readable. | When you sign in. | Removed when you sign out; otherwise it expires by itself after 30 days. |
bhl.mfa_recovery | Carries freshly generated recovery codes to the one page that displays them, during administrator security set-up. Administrators only — a customer account never sets it. | Only while an administrator sets up two-factor authentication. | Ten minutes, and cleared as soon as the codes are acknowledged. |
Both are httpOnly, which means no script running in the page can read them; both are sent only to this site and never to anyone else; and both are marked Secure so they travel only over an encrypted connection. Neither identifies you to any third party, and neither is used to build a profile of you.
We are sometimes asked whether there is a separate security or “CSRF” cookie. There is not. Forms on this site are protected by checking that the request came from this site rather than by storing anything in your browser.
Turning them off
You can block or delete cookies in your browser settings. Blocking the sign-in cookie will stop you signing in — it is the mechanism by which the site knows the next page you ask for is still you. Nothing on the public pages is affected, because nothing there depends on a cookie.
How we handle the information associated with your account is set out in the privacy notice.