Cookie Notice
Last updated 19 August 2026
Two things get stored in your browser. One is your own answer to the analytics question. The other only exists if you said yes.
Our own code sets no HTTP cookies — both items below are browser storage, which is covered by the same rules. Our host may set standard security and bot-management cookies while serving the request; those are strictly necessary and carry no analytics. The Privacy Policy covers the wider picture.
What is stored
| What is stored | Set by | Purpose | Strictly necessary? | Legal basis | Retention | How to opt out |
|---|---|---|---|---|---|---|
| Analytics session identifier | ~flock.js, injected by our deploy platform. Beacons to the same-origin proxy /~api/analytics, which is backed by a Tinybird pipeline. | Groups page views from one visit so we can see which recipes get read and how fast pages load. Pseudonymous: no name, no account, no cross-site identifier. | No — non-essential | Consent | Rotates after 30 minutes of inactivity. Event records kept no more than 12 months. | Choose Decline below, or switch on Global Privacy Control or Do Not Track in your browser. Declining blocks the requests in your browser. |
| st.consent.v1 (browser local storage) | This site. | Records your answer to the analytics question and enforces it on every page. Without it we would have to ask you on every visit. | Yes — strictly necessary | Legitimate interests: it exists only to honour the choice you made. | Until you change it or clear your browser data. It never leaves your device. | Clear your browser storage and the question is asked again. Declining still stores this one item — that is what makes the decline stick. |
Change your choice
Checking your saved choice…
The change applies immediately, in this tab and any other tab you have open. No account, no reload, no confirmation email.
How the block works
The measurement script is injected by our deploy platform rather than by this site's code, so we cannot simply leave the tag out of the page. Instead the site installs a guard in your browser: while your choice is undecided or declined, requests to /~api/analytics are dropped before they leave the device.
That covers the transports the script uses — fetch and navigator.sendBeacon — from the moment the page's own code runs. We re-check it before each release. The permanent fix, not injecting the script at all until consent exists, sits with the platform and we are pursuing it.
No advertising or affiliate script runs on this site today. The ad slots you see are empty reservations. If that changes, those scripts get the same treatment: nothing loads before consent.
Questions
Write to hello@stackandtossed.com and we will answer plainly.