Part 2. Cookie and storage policy
10. What this covers
This part covers cookies and any technology that stores or reads information on your device: local storage, session storage, and scripts that read device characteristics. UK and EU law treat them the same way. We need your consent unless the storage is strictly necessary for a service you asked for. UK law also allows a few other exemptions (see Section 13).
11. Your choices
- The banner. When you first visit from the UK, the EU, Switzerland, or anywhere we cannot place, a banner shows Accept all, Reject all and Choose. All three have the same size and weight. No box is ticked in advance.
- No cookie wall. Saying no never blocks you from reading the site.
- Changing your mind. Use Cookie settings in the footer of every page. Withdrawing is as easy as agreeing was.
- Global Privacy Control. If your browser sends it, we treat it as Reject all for everything optional, and we do not show the banner for those categories.
- We ask again after 12 months, or sooner if we add a new purpose.
- We keep a record of what you chose and when, linked to a random ID rather than to you, as proof of consent. See Section 15.
12. Categories
| Category | What it is for | Do we ask first |
|---|---|---|
| Strictly necessary | Sign-in, security and fraud checks on forms and checkout, your cart, remembering your cookie choice | No. The site or the feature you asked for cannot work without them |
| Preferences | Remembering choices such as light or dark theme in the code viewer, and demo settings | Yes, where the law requires it. Before you agree, the feature still works but forgets your choice next time |
| Embedded content | Live code samples from StackBlitz or CodeSandbox, and the framed demos | Yes, in the UK, the EU and Switzerland. Until you allow it, each one shows a button and loads only when you click it |
| Analytics | Not used | n/a |
| Advertising | Not used | n/a |
13. Full inventory
13.1 designsbyduhart.org (first party)
| Name | Type | Category | Purpose | How long |
|---|---|---|---|---|
__Secure-authjs.session-token |
Cookie, HTTP only | Strictly necessary | Keeps a console operator signed in. Set only for staff | 30 days |
__Host-authjs.csrf-token |
Cookie | Strictly necessary | Protects console sign-in from forged requests | Browser session |
__Secure-authjs.callback-url |
Cookie | Strictly necessary | Returns you to the right page after sign-in | Browser session |
__Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce |
Cookies | Strictly necessary | Secure the Google sign-in handshake | 15 minutes |
dbd.cart.v1 |
Local storage | Strictly necessary | Keeps the items in your store cart | Until you check out or clear storage |
dbd-theme |
Local storage | Preferences | Remembers light or dark mode in the live code viewer | Until you clear storage |
vitals-demo:* (settings, history, records, measurements, journal, food, saved foods, schedule, nutrition, macro plan, timers, training section, progress goals, plan and pace) |
Local storage | Strictly necessary for the demo you opened | Holds what you enter in the Vitals demo. It never leaves your device | Until you clear storage |
dbd-console-theme, dbd-console-palette-recent, dbd-console-draft:* |
Local storage | Preferences (staff only) | Operator console settings and unsaved drafts | Until cleared |
dbd_consent |
Cookie, readable by the page | Strictly necessary | Remembers your cookie choice and holds the random consent ID | 12 months |
Security ID dbd-sig (planned, not in use yet) |
Local storage, IndexedDB and a first-party cookie | Strictly necessary | A random ID used only by the fraud checks in Part 3 | 12 months |
13.2 NEURAL//RUN (first party, designsbyduhart.org/neural-run)
| Name | Type | Category | Purpose | How long |
|---|---|---|---|---|
__Secure-neuralrun.session-token |
Cookie, HTTP only | Strictly necessary | Keeps you signed in | 30 days |
__Secure-neuralrun.csrf-token, __Secure-neuralrun.callback-url, __Secure-neuralrun.nonce |
Cookies | Strictly necessary | Secure sign-in | Browser session |
__Secure-neuralrun.pkce.code_verifier, __Secure-neuralrun.state |
Cookies | Strictly necessary | Secure the Google sign-in handshake | 15 minutes |
neural-run:progress:v1 |
Local storage | Strictly necessary | Your game progress, hints and tutorials seen | Until you clear storage |
13.3 Live demos (demo.designsbyduhart.org, shown inside designsbyduhart.org/demos)
The demos run inside a frame from demo.designsbyduhart.org. Your browser treats that as a separate site, so these items are stored in a partitioned, third-party space. If you are in the UK, the EU or Switzerland, the frame loads only after you allow embedded content or click to open the demo.
| Name | Type | Category | Purpose | How long |
|---|---|---|---|---|
bo_rail |
Cookie | Preferences | Box Office studio layout | 1 year |
bo.device-id, theone.device_id |
Local storage | Strictly necessary | A random ID for this browser, used by the demo's sync and sign-in | Until cleared |
bo.sync-queue |
Local storage | Strictly necessary | Changes waiting to sync | Until synced |
billboard_play_events_v1, billboard_play_active_v1 |
Local storage | Functional | Records plays to send to the demo music service | Until sent |
billboard_queue_state_v1 |
Session storage | Strictly necessary | The player queue | Until the tab closes |
billboard_liked_tracks_v1, billboard_eq_state_v1, bb.suggested.collapsed, recent searches |
Local storage | Preferences | Liked tracks, equaliser, layout, search history | Until cleared |
dating.ageGate.dob.v1, dating.ageGate.rejected.v1 |
Local storage | Strictly necessary | The dating demo's age check. It stores the date of birth you enter | Until cleared |
dating_profile_location, dating.safetyTips.v1, recent emoji and searches, badges, notifications |
Local storage | Preferences | Dating demo state | Until cleared |
dating.pendingPurchase.v1 |
Session storage | Strictly necessary | A demo purchase in progress | Until the tab closes |
13.4 Third parties
| Name | Set by | Category | Purpose | How long |
|---|---|---|---|---|
| Cloudflare Turnstile | challenges.cloudflare.com | Strictly necessary | Checks the contact form is used by a person. Loads only on /contact | Per Cloudflare's policy |
cf_clearance |
Cloudflare | Strictly necessary | Set only if our host shows you a security challenge, to record that you passed it | Up to 1 year |
| StackBlitz, CodeSandbox, esm.sh | Those services | Embedded content | Run code samples you choose to load | Per their policies |
| Stripe | checkout.stripe.com, buy.stripe.com | n/a on our site | Set on Stripe's own pages when you pay | Per Stripe's policy |
| accounts.google.com | n/a on our site | Set on Google's pages when you sign in | Per Google's policy |
14. Controlling storage in your browser
You can block or delete cookies and site data in your browser settings. Blocking strictly necessary items stops sign-in, the cart and the demos from working. That is a consequence of how they work, not a penalty.
15. Consent records
When you make a choice in the banner, we store:
- a random consent ID;
- your choices;
- the version of this policy;
- your country (from your connection, not your exact location);
- the time;
- whether you used the banner or the settings page.
We keep it for 2 years after your last choice so we can prove what you agreed to. It does not contain your name, email or IP address.