The short version
Every cookie we set today is strictly necessary. They keep you signed in as an editor, protect our forms against CSRF, and remember your cookie preference. No third-party trackers run on this site unless you explicitly opt in via the cookie bar, and none are enabled today.
You can review or change your choice any time via the link in the footer.
Strictly necessary cookies
These cookies do not require consent under GDPR — they're what make the site work.
| Name | Purpose | Lifetime |
|---|---|---|
townloops_session |
Keeps editors signed in to the admin dashboard. Signed with a rotating server key. HttpOnly, Secure. | 7 days |
townloops_csrf |
CSRF double-submit token so forms can prove they came from a real browser session. | 7 days |
session |
Framework-level Starlette session cookie (reserved; unused for auth). | Session |
townloops_consent |
Remembers your choice from the cookie bar so you're not asked again. | 12 months |
Analytics cookies
Set only if you opt in via the cookie bar. When enabled, we use a self-hosted Umami instance. Umami is designed to be cookieless; it identifies a session via a rotating in-memory hash instead of a persistent identifier. The tracking script itself is fetched from our analytics subdomain, and we count that here for full disclosure.
Umami isn't running on this site yet. This section describes the behavior once it is.
If you send DNT: 1 or Sec-GPC: 1, the script never loads
regardless of your consent choice.
Preferences cookies
Currently unused. Reserved for future features like remembering a preferred town.
Browser storage (not cookies)
| Key | Purpose | Lifetime |
|---|---|---|
townloops:dismissed-sticky-cta (localStorage) |
Remembers that you dismissed the newsletter-signup bar so it stays hidden. Never transmitted anywhere. | Until you clear site data |
Third-party requests
We self-host our fonts, our analytics (when enabled), our newsletter service, and our image assets. Loading a Townloops page makes outbound requests to townloops.com only. If a page ever embeds an outside player like YouTube or Vimeo, we'll add it here first and gate it behind the "preferences" consent category.
Managing cookies at the browser level
Every modern browser lets you view, block, or delete cookies for a specific site. Doing so for Townloops will sign you out of the admin dashboard if you were signed in, break form submissions until you reload the page, and bring the cookie bar back. Nothing else breaks.