01 What this page covers
Cookies are small files a site stores in your browser. They are not the only way a site can put something on your device, so this page covers local storage as well — the law that governs cookies in Europe governs any storage on your device, and a policy that mentions only cookies is telling you half the story.
The full list is below. It is short, and we would rather show you the actual cookie names than describe them in categories.
03 Cookies this site sets
| Name | Purpose | Expires | Category |
|---|---|---|---|
| kommandhub-session | Identifies your browsing session so that a form you submit is recognised as coming from the page that served it. HTTP-only, so JavaScript cannot read it, and SameSite=Lax, so it is not sent on cross-site requests. | 2 hours | Strictly necessary |
| XSRF-TOKEN | Carries the cross-site request forgery token that the page sends back with every form submission. Without it, a third-party site could submit our forms using your browser. | 2 hours | Strictly necessary |
Both are first-party, set by our own server, and neither is used to identify you as a person or to follow you anywhere.
04 Local storage
| Key | Purpose | Expires | Category |
|---|---|---|---|
| color-scheme | Remembers whether you chose the light theme, the dark theme, or to follow your system setting. Written only when you use the theme toggle, and read before the page paints so it does not flash the wrong colour at you. | Until you clear it | Functional, set only on your action |
It stays in your browser. It is never sent to our server and we have no way to read it.
05 Third-party requests
Three parts of the site are loaded from other people's servers. Loading them does not necessarily set a cookie, but it does reveal your IP address to that provider, which is worth knowing either way.
| Service | Where | Storage it may use | Their policy |
|---|---|---|---|
| Cloudflare Turnstile | The three forms. | Cloudflare may store a short-lived value on your device to remember that a check has already passed, so you are not asked twice. It is a security measure, not a tracker, and it carries no advertising identifier. | Cloudflare privacy policy |
| Bunny Fonts | Every page — the typeface. | None. Font files are cached by your browser in the normal way. Bunny Fonts was chosen over Google Fonts precisely because it is built not to profile the people who load it. | Bunny privacy policy |
| OpenStreetMap | The map on the contact page. | The embedded map is served by the OpenStreetMap Foundation and may set its own cookies in your browser when it loads. | OpenStreetMap Foundation privacy policy |
Every other external link on this site is a plain link. Nothing is loaded from those services and nothing is sent to them unless you click through.
06 Controlling what is stored
Every browser lets you block or delete cookies and site data, usually under privacy or site settings, and usually per site. Your browser's own help pages explain how for the version you are running.
What happens if you block ours: the forms stop working, because the token that proves a submission came from our page cannot be stored. Reading the site is unaffected. We are not going to tell you to leave cookies enabled to be safe — block what you like, and know what it costs.
You can also clear the theme preference by clearing site data for this domain. The site will go back to following your system setting.
07 Questions
The wider picture — what we do with personal data, how long we keep it and what rights you have — is in our privacy policy. Anything this page does not answer: info@kommandhub.com.