Last updated: 21 October 2026
1. What cookies are
Cookies are small text files that a website stores in your browser. Similar technologies include local storage and tracking pixels. In this policy, “cookies” covers all of them.
2. The public website
When you browse the public pages, verify a certificate, file or track a complaint, apply for membership or send us a message, we do not set any cookies in your browser. We do not use analytics, advertising, social media or other tracking technologies, and we do not allow third parties to place cookies through our website.
Our fonts are served from our own servers, so loading a page does not cause your browser to contact a third-party font service.
To protect our forms from automated abuse, each form contains a hidden, signed timestamp and we count recent requests against a one-way hash of your IP address on our server. These measures do not store anything in your browser.
3. Cookies for signed-in staff
The administration area is used only by authorised GFCRS staff. When a staff member signs in, the following strictly necessary cookies are set:
| Cookie | Purpose | Duration |
|---|---|---|
authjs.session-token (served as __Secure-authjs.session-token over HTTPS) | Keeps a GFCRS staff member signed in to the administration system. It contains an encrypted session token. | Expires when the staff session times out |
authjs.csrf-token (served as __Host-authjs.csrf-token over HTTPS) | Protects the staff sign-in form against cross-site request forgery. | Session (deleted when the browser is closed) |
authjs.callback-url (served as __Secure-authjs.callback-url over HTTPS) | Remembers which administration page to return to after signing in. | Session (deleted when the browser is closed) |
These cookies are first-party, marked secure and HTTP-only where supported, and are not used for any purpose other than authentication and security.
4. Why we do not show a cookie banner
Under the Privacy and Electronic Communications Regulations 2003 (PECR), consent is not required for cookies that are strictly necessary to provide a service the user has requested, such as keeping a staff member securely signed in. As we use no other cookies, we do not need to ask for consent and we do not display a cookie banner. If we ever introduce non-essential cookies, we will ask for your consent first and update this policy.
5. Managing cookies
You can delete or block cookies in your browser settings. Blocking the staff cookies listed above will prevent signing in to the administration area but has no effect on the public website.
6. More information
For details of how we handle personal data, see our Privacy Policy. For general guidance on cookies, visit the Information Commissioner's Office website at www.ico.org.uk.