Cookie Policy
No tracking cookies, no analytics, no advertising, and nothing loaded from other websites. Just the few cookies the site needs to work and to stay safe, listed here in full.
Cookies are small pieces of text a website asks your browser to keep and send back on later visits. "Local storage" is a similar space in your browser that a site's own scripts can use; unlike cookies, it is never sent to the server. This page lists everything of both kinds that Handmade Hearts uses. It is part of the Terms, and the Privacy Policy explains the rest of how we handle information.
1. Our cookies
All of these are set by Handmade Hearts itself (first-party cookies), only work on this site, and are needed for it to work or to keep it safe.
| Name | What it does | How long it lasts |
|---|---|---|
sessionid |
Keeps you logged in, so you don't have to log in on every page. Set when you log in. It holds a random key; your session itself is kept on our server. | Until you log out, or 14 days |
csrftoken |
Security: a random token that proves a form (a message, a login, a setting) was really sent from this site and not by another website on your behalf. | Up to 364 days |
messages |
Carries a one-time notice, such as "Settings saved.", from one page to the next. Deleted as soon as the notice has been shown. | Until the notice is shown |
hh_signup_paused |
Only set if a date of birth under 18 is entered on the sign-up page. It pauses sign-up from that browser, so the adults-only rule can't be dodged by just trying another year. It contains nothing but the value "1" (signed, so it can't be faked). Your internet address is also paused for 24 hours, on our server only. | 30 days |
2. Security cookies from Cloudflare
Every visit to the site passes through Cloudflare, our network provider, which protects the site against attacks and automated abuse and blocks visits from the United Kingdom and Australia (see the Privacy Policy). Depending on its security settings and on the traffic it sees, Cloudflare can set the cookies below on our site. They are only used for security, not to follow you on other websites, and Cloudflare classes them as strictly necessary.
| Name | What it does | How long it lasts |
|---|---|---|
__cf_bm |
Bot protection: helps Cloudflare tell people apart from automated programs. | 30 minutes after your last visit |
cf_clearance |
Remembers that your browser passed one of Cloudflare's security checks (sometimes a "verify you are human" page, often done without you noticing), so you aren't checked again on every page. | 30 minutes by default |
_cfuvid |
Only used when a rate limit (a cap on how many requests can arrive in a short time) has to tell apart people who share one internet address, so that one person's traffic doesn't get everyone else on that address limited. | Until you close your browser |
cf_chl_rc_icf_chl_rc_nicf_chl_rc_m |
Used by Cloudflare's security check itself, to spot problems with the check. Only set when a check runs. | Short-lived |
Cloudflare lists every cookie its services can set, including ones for features this site doesn't use, on its cookie page.
3. Local storage
These are remembered choices you make yourself. They stay in your browser, are never sent to us, and can be deleted at any time by clearing this site's data in your browser.
| Name | What it remembers |
|---|---|
hh-theme | Whether you switched the site to dark mode with the Sun/Moon button. |
hh-plaza-music | The Plaza music player's song and volume. |
heartbeats-show-linked | That you ticked "always show" for pictures that Heartbeats link from other websites (until you untick it). |
heartmap-threads, heartmap-oneway | How you like the Kindred Hearts map drawn. |
registration_restricted | That a country where registration isn't available was picked on the sign-up page. |
4. Analytics and other companies
Handmade Hearts uses no analytics, advertising, social-media buttons or tracking pixels, and its pages load nothing from other websites: the fonts and scripts come from our own site. The one other company that sees your visits is Cloudflare, which carries all traffic to and from the site (section 2 and the Privacy Policy). Cloudflare gives us traffic statistics, worked out from the traffic it carries rather than from anything stored in your browser.
Your browser only contacts another website when you choose to:
- when you follow a link to another site, such as a member's own website or Ko-fi (from the Supporter page);
- when you load a picture that a Heartbeat links from another website. These pictures stay hidden until you click to show them (or tick "always show"), because the site that holds the picture can see who looks at it.
Those websites can set their own cookies and have their own privacy policies, which we don't control.
5. Why there's no cookie banner
Privacy laws such as the European Union's ePrivacy rules (with the GDPR) and similar laws elsewhere require a site to ask for permission before using cookies or browser storage that aren't strictly necessary, typically analytics, advertising and tracking. Cookies and storage that are needed to provide the service you asked for, such as staying logged in, security, or remembering a setting you chose yourself, don't need permission, but they do need to be explained, which is what this page is for.
Everything listed above falls into that second group, Cloudflare's security cookies included, and nothing on our pages shares your information with other companies for advertising or analytics, so we don't need to interrupt you with a consent banner. If we ever want to add something that needs your permission, we will ask for it first and update this page before it starts.
6. Managing cookies
You can see and delete cookies and site data in your browser's settings, and block them for this site. If you block the cookies in section 1, logging in and sending forms won't work. If you block Cloudflare's cookies in section 2, you may be asked to pass its security check more often, or not get through it. Deleting the sign-up pause cookie removes the pause from that browser; please don't do it to get around the age limit, which is against the Terms.
7. Changes and contact
When we add or remove a cookie or a kind of browser storage, we update this page and its "Last updated" date. Questions: [email protected].