Cookies and storage

This page says what this website puts on your device and what it keeps there. It is short because there is very little to describe, and it is written against what the site actually does rather than from a template.

If you are looking for what happens to the details you send through the contact form, that is the privacy notice. This page is only about your device.

This site sets no cookies

No cookies are set by this website, of any sort, for any purpose. Not for measurement, not for advertising, not for remembering you between visits, and not for anything the site needs in order to work.

There is nothing on this site that asks you to accept or reject cookies, because there is nothing to accept or reject.

There is one thing on the contact form that is not ours, and we would rather point you at it than let you find it: a security check, served by Cloudflare, which confirms an enquiry came from a person rather than from a machine. What it is and what we have and have not been able to establish about it are under "The security check on the contact form" below.

Measurement: Cloudflare Web Analytics, and why it needs no banner

This site measures how its pages are used, with Cloudflare Web Analytics. It counts page views, the pages visited, roughly where in the world a visit came from and which browser was used, all in aggregate. It does not build a profile of you, does not follow you from one site to another, and is not used for advertising.

It writes nothing to your device. No cookie, no local storage, no session storage, and no fingerprinting. That is checked directly, not assumed: open your browser's developer tools on any page of this site, look at what is stored for this domain, and you will find nothing Cloudflare Web Analytics put there, because there is nothing to find.

That absence is why this page carries no cookie banner for it and no opt-out control. The law requires permission before something is stored on your device or read back from it; where nothing is stored and nothing is read, there is nothing to ask permission for, and a switch offered anyway would be the same decoration a cookie banner would be here: something to click that changes nothing about what is measured, because nothing about you individually is measured in the first place.

The measurement script is served from Cloudflare rather than from this website. Your browser fetches it from static.cloudflareinsights.com and it reports to cloudflareinsights.com. The first of those is one of the two addresses this site loads from anywhere but itself, which "Two addresses this site loads from, and none of the rest" below sets out; the second is only reported to, and nothing is loaded from it. The script is accepted because it writes nothing to your device regardless of where it is served from. The other address is the security check on the contact form, and it has a section of its own further down. What would have to happen for any of this to change is under "If this ever changes" below.

What is actually kept on your device

One thing, on an ordinary visit, and it is ordinary machinery rather than this site recording anything about you.

• A copy of the pages, images and typefaces you have already loaded. Your browser keeps this for every website you visit, so that returning to a page does not fetch the same files a second time. It lasts until your browser discards it or you clear the browser's cache, and clearing it is entirely yours to do.

On an ordinary visit, nothing else is stored. No cookie, no local storage, no session storage and no database. Look at the storage your browser lists for this domain and you will find it empty. Two cases are not an ordinary visit and both are described below: a page that reloads itself when a new version is published, and the security check on the contact form.

The site does keep track of which published version your tab is showing, so that a page left open for a fortnight notices that a newer version has been published instead of asking for a file that no longer exists. That is held in the tab's memory rather than on your device. It is a small file fetched from this website like any other, kept while the page is open and discarded with it. There is nothing on your device to find or to clear, which is why looking for it turns up nothing.

The one time anything is written down is when the site reloads a page on its own: because a newer version has been published while your tab was open, or because a file the page needed did not arrive. As it reloads, its software leaves two short notes in that tab's session storage. One is the address it is reloading, which it reads back so that the reload cannot repeat itself. The other is a copy of the little the page was holding, which on this site is the year in the footer, and which nothing here ever reads back. Neither identifies you, neither is sent anywhere, and both belong to that one tab and go when you close it. An ordinary visit writes neither.

None of this identifies you, and none of it is sent anywhere. Nothing on this site writes an identifier, a visitor number or a record of what you have looked at into your browser's storage.

Two addresses this site loads from, and none of the rest

With the exceptions named on this page, everything a page needs is served from this website. There are two, both Cloudflare's: the measurement script above, on every page, and the security check below, on the contact form, the two product pages that carry the same form, and the pilot programme's application form.

• No advertising network, no social media widget, no embedded video and no chat box. If any of those is ever added, it loads only after you choose to interact with it, behind a placeholder that says what it is, rather than on page load. That includes the privacy-branded version of any video embed, which still writes an identifier to your device's storage on load and is not treated as an exception to this rule.
• No third-party content delivery network for anything but the two scripts named on this page. The scripts and styles that make a page work are files on this site.
• The typefaces are served from this website rather than from a font service, so loading a page here tells nobody outside our hosting provider and Cloudflare that you were reading it.

The security check on the contact form

The contact form carries a check that confirms an enquiry came from a person rather than from a machine. It is Cloudflare Turnstile, and it is the one part of the form that is not served from this website. For nearly everybody it finishes on its own: there is no puzzle to solve and nothing to tick, which is why it was chosen over the alternatives.

Why it is there. An audit of the enquiries mailbox found that most of what arrived was automated. The alternative to a check like this is losing real enquiries in the noise, or filtering on what a message says, which we will not do.

What Cloudflare learns. Loading anything from another company's server tells that company your device's internet address, which browser you are using, and the address of the page you are on. That is true of the check and it is true of any such request. What it is not given is your enquiry: the check is drawn in a frame of its own that cannot read the form around it, and nothing we send it contains anything you typed. When your enquiry is sent, we ask Cloudflare whether the check passed, and that question carries nothing about you, not even your internet address.

What it puts on your device, which is the part we cannot yet promise you in full. We looked, on 10 September 2026, with the check loaded and completed: no cookie, no local storage, no session storage, no database and no cached data was left behind for this website. What we could not see is what the check may keep inside its own frame, which belongs to Cloudflare rather than to us and is walled off from anything on this page. Cloudflare documents one cookie for this product, used only in a mode that requires a site to route its traffic through Cloudflare; this site does not, so that mode is not available to it and it is not switched on.

So the honest statement is that we found nothing and that we have not finished looking. When we have, this page says what we found, in the same release, whether it is nothing or something. If it turns out to keep anything on your device, this page will say what, why, and what you can do about it.

If you would rather not load it at all, the check needs JavaScript. With JavaScript switched off it does not load, nothing is fetched from Cloudflare, and you can still send your enquiry: the form works without it and we still read every one. Our email address is at the bottom of this page if you would rather write to us directly.

What sending an enquiry does

The contact form sends what you typed to a small handler on this same website, which passes it on for delivery by email. The form itself puts nothing on your device, before, during or after: no cookie, and no record of having written to us. The security check above is the one part of that page with a question mark against it, and it is answered as far as we can answer it there.

The check does add one thing to what is sent: a single-use pass, issued by Cloudflare in your browser, which travels with your enquiry so the handler can ask whether the check was passed. It is not an identifier, it is valid for a few minutes, it can be used once, and it says nothing about you.

To stop the form being flooded by a script, the handler limits how many enquiries one internet connection may send in a ten minute window. That limit is held in the memory of the server, as a one-way hash rather than as your address, and nothing about it is put on your device. If you do reach the limit the form says so and asks you to wait, which is the whole of what you see of it. The privacy notice describes it, and everything else that happens to your enquiry, in full.

What our hosting provider sees

This website is a set of files prepared in advance and served as they are. Microsoft hosts it, and, as any host does, keeps its own operational records of the requests made to it. That happens on their systems rather than on your device, and we do not use those records to measure anything.

Reading a page adds nothing to them beyond the request for the page itself. Sending an enquiry adds one line, which says whether the enquiry was delivered and, where something was filled in wrongly, which boxes. It never records what you typed and it never records your address on the internet. The privacy notice sets that out in full.

Why there is no cookie banner

The law requires a website to ask permission before it stores anything on your device or reads anything back from it, unless what it stores is strictly necessary for the thing you asked for. What is listed above is the browser's own handling of files it has already fetched and, in the one case where the site reloads itself, two notes that are there so the page you asked for arrives once and arrives whole. Nothing in either is stored or read in order to learn anything about you, and nothing in either is used for measurement, for advertising, or for recognising you on a later visit.

So there is no permission to ask for. A banner here would be asking you to consent to nothing, and the habit of clicking through those is worth more to everybody than one more of them.

The security check on the contact form is the one thing that could change that, and it is being treated as unfinished rather than as settled. We found nothing on your device from it and we could not see inside its own frame, which is set out above. If it turns out to keep something there, the question is whether it is strictly necessary for the thing you asked for, which is sending us an enquiry that reaches us. A check that exists only to stop a form being flooded, on a page you chose to open, is a strong case for that; it is not a case we will make on this page before we have looked properly. Whatever we find is published here in the release that establishes it.

If this ever changes

Adding anything that stores or reads something on your device, analytics included, means publishing what it is and how to refuse it on this page, in the same release that adds it, and before it collects anything. The date at the top of this page is the date this version took effect, and it changes in the same edit that changes anything above it. There is one current version rather than an archive of superseded ones.

Checking any of this for yourself

You do not have to take our word for it. Open your browser's developer tools on any page of this site, look at the cookies it lists for this domain, and you will find none. Look at the storage listed beside them, and you will find that empty too. Look at the requests the page made, and every one of them is this website's own except the measurement script described above and the two it makes to report a page view. Look at what any of those three stored on your device, and you will find nothing.

On the contact page there is more to see, because of the security check: the request that fetches it, and the frame it draws itself in. Look at the storage listed for this domain there too and you will find it empty, which is what we found. The frame's own storage is listed separately by the browser, under Cloudflare's address rather than ours, and that is the part we say above we have not finished checking. If you look there and find something, we would particularly like to hear about it.

If anything on this page turns out not to match what you find, we would like to know rather than not know. Write to us at: