Cookie Policy

The position

No cookie on this site originates with us. Nothing here measures you, profiles you or advertises to you. There is no tag manager, no social widget, no embedded video, no tracking pixel, and no browser storage written by our own code.

What this means in practice

Two cookies may appear, both placed by Cloudflare, the security and delivery layer in front of this site, and both there to tell a person apart from an automated request. Because they are strictly necessary to deliver the page you asked for, the law does not require your consent for them, which is why you are not asked for it. Item 04 names them individually.

One outbound request deserves flagging, since anyone inspecting the network tab will find it: our lettering is served from Google's font infrastructure, so returning those files puts your browser's request in front of Google. Item 04 sets out what that involves and what we intend to do about it.

The position

A cookie is a short string handed to your browser for safekeeping and returned automatically on subsequent visits. The distinctions that follow are not pedantry — each one decides which rule bites.

What this means in practice

• Whose domain sets it. A first-party cookie comes from the site in your address bar. A third-party cookie arrives from a different domain whose material the page has loaded, which is the everyday machinery behind advertising that trails people from site to site.
• How long it lasts. A session cookie disappears when the browser closes. A persistent one survives until it expires or you clear it.
• Whether it is necessary. A strictly necessary cookie delivers something you actually asked for — security, load balancing, staying signed in. Everything else, measurement and personalisation and advertising included, is non-essential, and the difference decides whether consent is needed.

The law does not stop at cookies. It reaches anything that writes to, or reads from, your device, and treats all of it the same way:

• Local and session storage — browser-side stores a site can write to, holding rather more than a cookie and not attached to every request.
• Pixels and beacons — a minute graphic, or a snippet of script, planted in a page or a message and reporting home the instant it renders.
• Fingerprinting — assembling a stable identifier out of your browser and device characteristics instead of storing one, which is no less tracking for leaving nothing behind.
• Application storage and embedded kits — the mobile equivalents, covered at item 08.

The position

Two pieces of UK law govern this, and they do different jobs. One says when permission is needed. The other says what permission has to look like before it counts.

What this means in practice

Regulation 6 of PECR says that putting information on your device, or reading information already there, requires that you be told clearly what it is for and that you agree to it. Two exemptions cut across that. The first covers storage or access whose only function is transmitting a message across a network. The second covers whatever is strictly necessary for delivering a thing you expressly requested — and security measures keeping a requested page reachable, and free of automated abuse, fall inside it.

The UK GDPR supplies the standard that agreement must reach: freely given, specific, informed, unambiguous, and signalled by a clear affirmative act — with withdrawal made no harder than the giving was. A pre-ticked box does not reach it. Nor does agreement inferred because you carried on scrolling, nor a wall that offers no genuine alternative. Where storage also involves personal data, the UK GDPR governs that handling too, and our Privacy Policy covers it.

Put together: anything non-essential must stay switched off until you actively choose otherwise, while anything strictly necessary needs clear information but not permission. This site carries only the second kind.

The position

The table below is the complete inventory. Where something is not in it, it is not here.

What this means in practice

The two Cloudflare cookies serve no measurement or advertising purpose, do not identify you to us by name, and are not joined to anything else we hold. The handling of your network address and request record that goes alongside them is described at item 05 of the Privacy Policy.

The font request. Our lettering arrives from Google's font infrastructure rather than from our own server. That means your browser makes a request to a Google-operated domain, and in the course of returning the files Google receives your network address and browser string. No cookie is placed on this site by that request, and nothing about it reaches us or is used by us for any purpose. Serving those files from our own infrastructure, so that the request disappears entirely, is under review, and this memorandum will record the change if we make it.

The position

Running measurement here was considered and rejected. We would have learned a little about which pages get read; you would have paid for that with a consent decision on arrival and a record of your visit sitting with a third party. For a small site whose whole job is to explain what we do and invite an email, that exchange is not worth making.

What this means in practice

Advertising technology is absent in every form: no networks, no conversion pixels, no remarketing tags, no audience lists, no data-broker connections and no identifiers shared across sites. Data about readers is neither sold nor shared, and it is never enriched or appended to.

Some traffic information reaches us regardless, because a page cannot be served without the request arriving. Cloudflare produces aggregate counts of requests, bandwidth and blocked threats, carrying no identification of any individual. That is a by-product of hosting rather than a measurement product, it places nothing on your device, and it is not used to assemble a picture of anybody.

The position

Everything present here qualifies as strictly necessary under the regulation 6(4) exemption, which means the law asks for no consent to it. A banner asking for permission we do not need would be posing a question with no meaning behind it.

What this means in practice

There is a second reason, and it is the one we care about more. A consent banner on a site that does not track anybody teaches readers to dismiss banners without reading them, which degrades the value of consent on every site they visit afterwards. Adding one here would buy us the appearance of compliance at everybody else's expense.

What the law does require for strictly necessary storage is clear information, and this memorandum is that information. Should the position ever change, the request arrives before the technology does, as item 07 sets out.

The position

Should we ever decide to introduce measurement, or any other non-essential storage, five commitments bind us and every one of them is discharged before the technology goes anywhere near this site.

What this means in practice

• A consent mechanism that holds the technology back until you opt in, with refusal presented as prominently as acceptance, and with no pre-ticked boxes and no consent inferred from your behaviour.
• A route to withdraw that is no harder than the route to give, honoured by removing the technology and, so far as we are able, whatever storage it created.
• The inventory at item 04 updated with the name, provider, purpose, kind and lifetime of every new entry, and the Privacy Policy updated wherever personal data is involved.
• The version number and date at the head of this memorandum revised.
• The site kept entirely functional for anyone who declines. No feature will ever be withheld as the price of consent.

The position

A mobile application uses no browser cookies, but it certainly writes to your device, and regulation 6 reaches that storage exactly as it reaches a cookie.

What this means in practice

Three things are written to the device: your content and settings, so that the product works with no connection; an authentication token, so that you are not signed out between sessions; and a random per-installation reference used for grouping failure reports and for support. All three are strictly necessary to provide the product you asked for, and none of them is an advertising identifier.

Where an application includes optional feature counters, and recording them means storing or reading anything on your device beyond what is strictly necessary, we ask inside the product before switching them on, and the choice can be changed at any point from the privacy settings. Declining costs no feature. Our applications carry no advertising kits, never read the iOS Identifier for Advertisers or the Android Advertising ID, and present no App Tracking Transparency prompt, because there is nothing there to track. Item 24 of the Privacy Policy carries the full detail, including our Data Safety and privacy label position.

The position

Cookies are yours to inspect, block and clear whenever you like. Blocking the Cloudflare cookies is entirely permitted and this site continues to work, though you may meet a security challenge rather more often than you otherwise would.

What this means in practice

Menu wording shifts between versions, so your browser's own help pages will be more current than any table. Most browsers also offer a private window, whose cookies and storage are thrown away as soon as it shuts. Blocking cookies across the board will affect other sites that depend on them for signing in and for baskets.

The position

Two browser signals exist for telling a site to leave you alone. Neither changes anything here, and the honest reason is that there is nothing running for either of them to switch off.

What this means in practice

Do Not Track was a header a browser could send asking sites not to follow the reader. It never became a standard, no UK law obliges a site to honour it, and most browsers have withdrawn the setting. We take no action on it, though indifference is not the reason: nothing here follows anybody, so the signal finds no target.

Global Privacy Control is a newer signal, registering an objection to personal data being traded on and, in certain jurisdictions, to advertising aimed by profile. Since nothing is traded on here and no advertising is aimed at anybody, the signal alters none of this site's behaviour; the activity it asks us to halt was never running. Were non-essential storage ever introduced under item 07, we would treat an incoming signal as a valid objection and place nothing non-essential for that reader.

The position

This memorandum is reviewed at least annually, and additionally whenever the technology on the site or inside an application changes. The edition in force always sits at this address carrying its number and date.

What this means in practice

Where a revision introduces a new cookie or a new storage item, the inventory at item 04 is updated before the item is deployed, and item 07 governs how permission is obtained for anything non-essential.

Version record. Version 1.0, 31 July 2026, first publication. Version 2.0, 5 August 2026, adding the wider technologies covered, the legal framework, a complete inventory, the font disclosure, our position on measurement and advertising, application storage, per-browser routes and the position on both browser signals. Version 3.0, 15 August 2026, recasting the whole document as a numbered memorandum and stating for each item the action owed to the reader.

The position

Put questions about this memorandum — or about anything your browser turns up after a visit here — to enquiries@therevenuehouse.uk.

What this means in practice

A person reads that address and replies within one business day. A question about what a particular cookie does will be answered specifically rather than with a link back to this page.