We use a small number of cookies — no advertising cookies. Most are strictly necessary; the only optional ones are analytics cookies, and those are set only if you accept them. Here is exactly what each one does.
1. Session cookie
Keeps you signed in as you move between pages. Expires when your browser session ends or after a period of inactivity. Strictly necessary — the site cannot function without it.
2. CSRF token cookie
A security cookie that protects forms (registration, profile updates, payments) from being submitted by malicious third-party sites on your behalf. Strictly necessary.
3. Referral code cookie
If you arrive via a member's referral link (a URL containing ?ref=CODE), we set a cookie remembering that code for 90 days, so it's still applied automatically if you come back later to finish signing up. If you later follow a different member's referral link, the newer code replaces the older one. You can clear this at any time by clearing your browser's cookies for this site, or by manually removing the referral code shown on the registration form before submitting it.
4. Remember me cookie
Set only if you tick "Remember me" at login, so you stay signed in across browser restarts. You can remove it by logging out.
5. Cookie preference cookie
Remembers whether you accepted or declined analytics cookies, for one year, so we do not ask on every visit. It contains no personal information. Strictly necessary for respecting your choice.
6. Analytics cookies (optional)
If analytics is turned on for this site, we ask for your consent first. Only if you choose Accept do we load our analytics tools (for example Google Analytics), which set cookies that help us understand how the site is used — which pages are visited and how visitors arrive. If you choose Decline, no analytics code is loaded and no analytics cookies are set, and the site works exactly the same. You can change your choice at any time using the "Cookie settings" link in the footer of any public page.
7. Sign-in security cookie
When you sign in we set a random identifier in a cookie, kept for two years, so we can tell whether a sign-in is from a browser your account has used before. If it is from a new one, we email you a security alert with the device and IP address so you can react if it was not you. The identifier is stored only as a hash next to a short record of your sign-ins. Strictly necessary for account security.
8. Controlling cookies
Every modern browser lets you view, delete, or block cookies from its settings. Blocking the strictly necessary cookies above will prevent you from signing in.