Interlinked - The Cube
Cookie Notice
Two cookies. No tracker, no tag manager, no advertising pixel, and no banner asking you to accept any.
Why there is no cookie banner
A banner exists to collect consent for storage that is not strictly necessary. This
application has none of the kind that usually needs one. There is no analytics vendor,
no tag manager, no advertising pixel, no embedded social widget and no third-party
script of any sort: every response carries a content security policy whose default is
'self', and images are the only thing allowed to come from elsewhere
(the artwork store).
The one cookie that is not strictly necessary is the viewing-visit cookie, and consent for it is taken on the screen it belongs to, in words about what it does, instead of in a banner about cookies in general. If you choose BROWSE PRIVATELY, that cookie is never set.
Strictly necessary
Set because the thing you are doing cannot work without it. No consent is required for these.
| Name | What it does | Lifetime | Detail |
|---|---|---|---|
il_session | Keeps a gallery user signed in. | 30 days, slid forward when under 15 days remain | HttpOnly, SameSite=Lax, Secure over https. Holds an opaque random token; the database stores only its SHA-256, so a stolen database cannot be replayed as a live session. Set only after a successful sign-in. (src/lib/auth/session.ts) |
Set only after you agree
| Name | What it does | Lifetime | Detail |
|---|---|---|---|
il_room_<room> | Identifies one viewing visit, so a collector who reloads is the same visit and not a new one. | 8 hours | HttpOnly, SameSite=Lax, Secure over https. Holds nothing but a `room_sessions` id. One cookie per room, so two rooms are two independent visits. It is set at the moment the collector accepts the viewing record and never before, choosing BROWSE PRIVATELY sets no cookie and produces no measurement. (src/lib/room/session.ts) |
What is not a cookie but is worth saying
- Nothing tracking is kept in local storage. The mobile applications keep a sign-in token in the operating system's own secure preference store, which is the native equivalent of the session cookie and serves the same single purpose.
- Your IP address is not written down. A visit records a salted, truncated SHA-256 of it, which cannot be turned back into an address, and that hash is blanked after 90 days.
- Your browser's User-Agent string is recorded against a measured visit, and against each sign-in session, and is blanked on the same 90-day schedule for visits.
Refusing or removing them
Signing out removes the session cookie. Closing the viewing room and clearing site data in your browser removes the visit cookie; it also expires on its own after eight hours. Blocking cookies entirely will stop a gallery user being able to sign in, because the sign-in cookie is what keeps them signed in, and will make the viewing room behave as if you chose to browse privately.
Deleting the visit cookie does not delete what has already been measured. To have that destroyed, ask us.