Cookie Policy
We use the smallest set of first-party cookies and browser storage that lets the site work and lets us measure which articles resonate. There are no advertising or re-targeting cookies, anywhere. With your consent we also load Google Analytics 4 to aggregate readership patterns — details below.
What we set
The table below is the complete list — if it's not here, we don't set it.
| Name | Kind | Purpose | Retention | Category |
|---|---|---|---|---|
| studio_sid | Cookie | Keeps Studio editors signed in. | 24 hours | Strictly necessary |
| google_oauth_state | Cookie | CSRF protection during Google sign-in. | 10 minutes | Strictly necessary |
| gg_consent | Cookie | Records your cookie preferences so we don't ask again. | 13 months | Strictly necessary |
| theme | localStorage | Remembers your light / dark mode preference (set by next-themes). | Until you clear site data | Strictly necessary |
| gorgorus_visitor_id | localStorage | Anonymous first-party ID that lets us count unique readers and measure read-depth without a login. | Until you clear site data | Analytics |
| gorgorus_member_uuid | localStorage | Links reads to your subscriber record when you arrive from a newsletter link. | Until you clear site data | Analytics |
| gorgorus_acquisition | sessionStorage | Remembers the UTM campaign that brought you to the site, for the duration of the tab. | Until the tab closes | Analytics |
| _ga | Cookie | Set by Google Analytics 4 (loaded via Google Tag Manager) to distinguish unique visitors. Only set if you grant analytics consent. | 2 years | Analytics |
| _ga_F87MQ01HN4 | Cookie | Set by Google Analytics 4 to persist session state for our GA4 property. Only set if you grant analytics consent. | 2 years | Analytics |
Categories
Strictly necessary
Required for the site to function — authentication, CSRF protection, saving your cookie choices, and remembering your theme. No consent is required under ePrivacy Article 5(3) and these cannot be turned off.
Analytics
Two layers, both opt-in. (1) Our own first-party counters measure page views, read-depth, and which newsletter campaigns bring readers in — data stays on our AWS infrastructure. (2) Google Analytics 4, loaded via Google Tag Manager, gives us aggregated traffic and acquisition reports; Google LLC acts as a data processor under our DPA, the GA4 property is configured for IP anonymisation and EEA data routing, and no advertising features (Signals, Audiences, Remarketing) are enabled. No analytics data is sold or used for advertising.
Embeds
Third-party content inside articles — charts, videos, social embeds — that may set their own cookies when loaded. Off by default; granting this category lets those embeds render.
How we record your choices
When you accept, reject, or save a custom set of preferences we write the gg_consent cookie and a row in our server-side audit log. The log contains the timestamp, version of this policy, your choices, and a salted daily hash of your IP address (not the IP itself). We keep audit rows for 13 months, per EDPB guidance, then purge them.
Change your mind
Use Cookie preferences any time — the footer of every page links back here. Denying analytics also clears any visitor ID we had previously stored in your browser.
Last reviewed: 28 April 2026