The short version
Every cookie we set today is strictly necessary. They keep you signed in as an editor, protect our forms against CSRF, and remember your cookie preference. No third-party trackers run on this site unless you explicitly opt in via the cookie bar, and none are enabled today.
You can review or change your choice any time via the link in the footer.
Strictly necessary cookies
These cookies do not require consent under GDPR — they're what make the site work.
| Name | Purpose | Lifetime |
|---|---|---|
townloops_session |
Keeps editors signed in to the admin dashboard. Signed with a rotating server key. HttpOnly, Secure. | 7 days |
townloops_csrf |
CSRF double-submit token so forms can prove they came from a real browser session. | 7 days |
session |
Framework-level Starlette session cookie (reserved; unused for auth). | Session |
townloops_consent |
Remembers your choice from the cookie bar. Currently used to suppress the analytics tracker if you explicitly rejected it (see below), and to store your Preferences category for future use. | 12 months |
Analytics — cookieless
We use a self-hosted Umami instance for basic page-view counts. Umami is cookieless — it identifies a session via a rotating in-memory hash of IP address, User-Agent, hostname, and a per-day salt. Nothing is stored on your device, and the identifier can't be used to link visits across days.
Because no cookie or persistent identifier lands on your browser, Umami loads on every visit unless one of these three signals is present:
- Your browser sends
Sec-GPC: 1(Global Privacy Control) — legally binding opt-out in California. - Your browser sends
DNT: 1(Do Not Track). - You opened Cookie preferences and unchecked Analytics, then saved. The
townloops_consentcookie records that choice; we suppress the tracker on every subsequent request.
Common browsers that ship Sec-GPC or DNT by default include Brave,
Firefox with tracking protection, DuckDuckGo Browser, and Safari
with certain configurations.
Preferences cookies
Currently unused. Reserved for future features like remembering a preferred town.
Browser storage (not cookies)
| Key | Purpose | Lifetime |
|---|---|---|
townloops:dismissed-sticky-cta (localStorage) |
Remembers that you dismissed the newsletter-signup bar so it stays hidden. Never transmitted anywhere. | Until you clear site data |
Third-party requests
We self-host our fonts, our analytics (when enabled), our newsletter service, and our image assets. Loading a Townloops page makes outbound requests to townloops.com only. If a page ever embeds an outside player like YouTube or Vimeo, we'll add it here first and gate it behind the "preferences" consent category.
Managing cookies at the browser level
Every modern browser lets you view, block, or delete cookies for a specific site. Doing so for Townloops will sign you out of the admin dashboard if you were signed in, break form submissions until you reload the page, and bring the cookie bar back. Nothing else breaks.