What cookies are
A cookie is a small text file that a website asks your browser to store on your device. When you come back — either on the same visit or weeks later — your browser sends the cookie back with each request, so the site can recognise the session, remember a preference, or count a unique visit. Cookies are not executable code, cannot read files on your device, and cannot identify you beyond the data the site already has about you.
This page lists every cookie peatpost sets on peatpost.com and every local-storage key it writes, the category each one belongs to, its lifetime, and the flags that govern how the browser treats it. Local storage is a related-but-different mechanism that we use for a few preferences that never need to leave your device.
Categories we use
Following the categorisation expected under the EU ePrivacy Directive, the UK’s PECR rules, and the CCPA, everything peatpost stores on your device falls into one of two buckets:
- Strictly necessary. Required for the site to function or to record your consent: the staff session cookie and the consent cookie. These cannot be switched off in the banner because turning them off would stop the site working as you reasonably expect.
- Preferences. Conveniences that remember choices you have made — your theme, your saved stories, and the name you use to comment — so we do not have to ask again on every page. These live in local storage rather than in cookies, and they are optional.
We set no analytics cookies, no advertising cookies, and no third-party cookies, and we load no analytics script. That is why the consent banner offers only the two categories above. “Accept all” turns Preferences on; “Reject non-essential” turns Preferences off, in which case the three conveniences listed below are not persisted between visits.
Cookies we set
The table below lists every cookie set by peatpost, with its name, purpose, category, lifetime, and security flags. There are two.
| Name | Purpose | Category | Duration | Flags |
|---|---|---|---|---|
| pp_session | Authenticates editorial staff who have signed in to the admin area. Only set after a successful sign-in; ordinary readers never receive it. | Strictly necessary | 7 days | HttpOnly, Secure, SameSite=Lax |
| peatpost_consent | Records the choice you made in the cookie banner so we do not ask again on every page. Holds a small URL-encoded JSON value: which categories you allowed and when you chose. | Strictly necessary | 1 year | Secure, SameSite=Lax |
Where you see HttpOnly in the flags column, the cookie cannot be read by JavaScript on the page; only the server can see it. Secure means the cookie is only ever sent over HTTPS. SameSite=Lax means the cookie is not sent on cross-site requests other than top-level navigation, which mitigates a class of cross-site request-forgery attacks. The consent cookie is written by the banner in your browser rather than by our server, which is why it is not HttpOnly.
Third-party cookies
We do not run advertising networks, social-media widgets, embedded media players, or analytics scripts on peatpost, so no third party sets cookies through our pages. Our fonts are bundled at build time and served from peatpost.com, so no font network sees your visit.
Story images may be loaded from third-party hosts — for example Pexels, CoinGecko, or Wikimedia — when an article’s picture lives there. Loading an image is an ordinary request to that host, which sees your IP address and browser details under its own privacy policy. Those hosts set no cookies on our behalf, and we control none they might set for their own purposes.
Cookies vs. local storage
Cookies are tied to a domain, sent on every request to that domain, and constrained by their flags. Local storage is a separate browser feature that lets a site keep small key-value pairs on your device that are never automatically attached to network requests. We use local storage for the three Preferences below. They are written only if you allowed Preferences in the consent banner; if you rejected non-essential storage, the features still work for the page you are on but nothing is remembered between visits.
- theme — Whether you chose the dark interface, so the right colour scheme paints before the page hydrates. peatpost is light by default; dark mode is opt-in.
- peatpost_saved — The list of stories you have bookmarked with the “save” button, shown on the Saved stories page. Stays on your device; we do not have a copy.
- peatpost_comment_name — The display name you last used when posting a comment, so the comment form can prefill it next time.
Clearing site data in your browser removes both cookies and local-storage entries. Your saved stories will not survive the clear, because we do not hold a copy.
How to manage your cookies
The most direct way is to use the consent banner that appears on your first visit. If you have dismissed it, the Manage your cookie preferencesbutton at the top of this page reopens it so you can change your choices. The same control is available from the footer of every page under “Manage cookies”.
You can also manage cookies at the browser level. Every modern browser has a settings area that lets you view, block, or delete cookies for a given site:
- Chrome: Settings → Privacy and security → Cookies and other site data.
- Firefox: Settings → Privacy & Security → Cookies and Site Data.
- Safari: Preferences → Privacy → Manage Website Data.
- Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
Blocking pp_session stops editorial staff signing in; it has no effect on reading the site. Blocking peatpost_consent means we cannot remember your choice, so the banner will reappear on every visit. Turning off Preferences, or blocking local storage, means your theme, saved stories, and comment name are not remembered between visits.
Do Not Track and Global Privacy Control
We set no non-essential cookies, run no cross-site trackers, and do not sell or share personal information as the CCPA defines those terms. There is therefore nothing for a Do Not Track (DNT) or Global Privacy Control (GPC) signal to switch off: a browser sending either signal is treated exactly the same as one that does not, which is already the most private setting we have.
Changes to this policy
If we add or remove a cookie or a local-storage key we will update the tables above and refresh the “Last updated” date. Material changes — for example adopting an analytics provider, or starting to set advertising cookies — would add a category to the consent banner, and we would reset stored consent so the banner asks you afresh. We will not silently expand what we store.
Contact
Questions about cookies? Write to privacy@peatpost.com. For the broader explanation of how we handle personal data see the Privacy Policy.