How we handle this
Most sites drop their analytics cookies as the page loads and ask afterwards. We do not, and we have checked that we do not: until you accept, analytics keeps nothing on your device and sends nothing anywhere.
If you ignore the banner, that counts as no. If you decline, that is the end of it - we do not ask again on every page.
Essential - always on
These do not need consent under the rules, because without them the site cannot do what you have asked it to.
- Consent record (CookieYes). Remembers what you chose, so we can honour it and prove we asked. Set when you interact with the banner.
- Sign-in session (Supabase). Only if you sign in. Keeps you signed in between pages. Cleared when you sign out.
- Poll vote (this site, cc_poll). Only if you vote in a readers’ poll. A random code, set when you vote, so each device votes once. It holds nothing about you, is sent only when you vote, and is deleted after a year (or whenever you clear your cookies). We keep a scrambled form of it beside the poll, never the code itself and never which answer you chose.
- Your lists (this site). Only if you make a list or an advent calendar. Keeps its name and private edit link in your browser’s local storage, so you can find and edit it again, and is never sent anywhere except to edit that list. Removed with “Forget the lists on this device” on Your lists, or by clearing your browser’s data.
Rate limiting also briefly holds a value derived from your IP address, but that sits on our side rather than on your device, so it is not a cookie.
Page counts - no cookies
We also count page visits with Vercel Web Analytics, the analytics built into our hosting. It stores nothing on your device: no cookie, no identifier. It sees the page address (never anything after a question mark or a hash), where you came from and the rough type of device, and it cannot tell one visit of yours from the next day’s. That is why it does not ask first.
Analytics - only if you say yes
We use PostHog, on its European servers, to understand which films people actually read about and whether the site is any use. If you accept, it stores a random identifier on your device so it can tell one visit from two.
It records pages viewed and a small number of events - for instance, that somebody joined the mailing list from the watchlist page. It is never sent your email address, and we do not use it to build a profile or to advertise to you.
Decline, and none of that identifier is written and no request is made. That is a deliberate configuration choice, not a default.
If you accept, we may also record a replay of your visit - the pages you moved between and what you clicked - kept for 30 days and then deleted. It is how we find the bits of the site that do not work.
Anything you type is blanked before it leaves your browser. The masking happens on your device, not on our side, so form fields never reach us at all. Decline analytics and no recording happens in the first place.
Videos - only when you press play
Some pages, such as our Christmas adverts, can play a video from YouTube, which is run by Google. The player is not part of the page when it loads. Until you press play, nothing from YouTube is loaded and nothing of theirs is stored on your device. Where the video will go, we show one of our own illustrations, not YouTube’s picture.
If you have allowed functional cookies in the banner, pressing play loads the player straight away. If you have not, we ask first: you can play that one video here, or watch it on YouTube instead. Choosing to play here covers that video only, and we do not remember the choice.
Once the player has loaded, YouTube may set cookies or use similar storage on your device, under Google’s privacy policy rather than ours. We use its privacy-enhanced mode (youtube-nocookie.com), which reduces what it stores before you watch but does not remove it. That is why we ask.
Maps of filming locations
Some film pages show a map of where the film was made. The map pictures come from OpenStreetMap, from tile.openstreetmap.org, and load when you reach the page, without asking. They set no cookies and store nothing on your device: your browser simply asks OpenStreetMap for the map squares it needs.
The location’s name and description are on the page as text, so you never need the map to read them.
What we do not use
No advertising cookies. No social media pixels. No cross-site tracking. No fingerprinting. There is no ad network on this site and no plan to add one. The one third party that can store anything on your device from our pages is a YouTube video you choose to play, described above. The OpenStreetMap map pictures store nothing.
Shops we link to set their own cookies once you are on their site. We have no control over those - their policy applies, not ours.
Changing your mind
Use the cookie settings link in the banner to change your choice at any time. Withdrawing consent stops analytics immediately.
You can also clear cookies in your browser, or block them entirely. Blocking the essential ones will sign you out and make the banner ask again; the rest of the site will work fine.
More detail
The privacy notice covers what we do with the data itself, who processes it and how to get it deleted. Anything not answered in either, email darren@digitopiadesign.com.