Cookies

1. What this site sets

A session cookie (humsess). Set when you load a page containing the contact form. It carries the CSRF token that protects the form against cross-site request forgery. It is HttpOnly, SameSite=Lax, Secure over HTTPS, and expires when you close your browser. It is strictly necessary, and carries no identifier that could be used to track you.

A consent cookie (hum_consent). Written only once you answer the consent banner, recording whether you accepted or declined analytics, so that you are not asked again. It is first-party, SameSite=Lax, and lasts one year. It stores nothing but that choice.

2. Analytics cookies

This site uses Google Analytics 4, loaded through Google Tag Manager. No analytics script is fetched and no analytics cookie is written until you accept the consent banner. If you decline, or simply ignore the banner, nothing loads.

If you accept, Google Analytics sets:

• _ga — a randomly generated identifier used to distinguish one browser from another. Expires two years after it is set.
• _ga_<container> — used by Google Analytics 4 to maintain session state. Expires two years after it is set.

Both are stored as first-party cookies. We use this only to count visits and see which pages are read; we do not use it to build advertising profiles, and the data is not sold.

You can withdraw consent at any time by deleting the hum_consent cookie in your browser, which brings the banner back, or by deleting the _ga cookies directly. Google also publishes a browser add-on that opts you out of Google Analytics on every site.

3. Third-party cookies

The Google Analytics cookies described in section 2 are set by a script served from Google (googletagmanager.com). They are stored as first-party cookies on this domain, but Google is the recipient of the resulting data.

No other external script, font, or image is loaded. The site's Content-Security-Policy permits requests only to this site and, once you have accepted, to Google's analytics endpoints. Nothing else can make a request from these pages.

4. Managing cookies

humsess is strictly necessary; blocking it will prevent the contact form from working. Everything in section 2 is optional and off until you opt in. You can block or delete any cookie in your browser settings.

5. Changes

We may revise this policy. The revision date is shown at the foot of this page.

Last updated 23 Jul 2026.