Cookie Policy

The cookies we set

A session cookie keeps you signed in between page loads. It is marked HttpOnly, so no script can read it, and SameSite=Lax, so it is not sent from other sites.

An XSRF-TOKEN cookie proves that a request came from Narrale and not from a page pretending to be Narrale. Without these two the app cannot sign you in at all, which is why they have no opt-out.

A third cookie, __cf_bm, is set by Cloudflare, the network in front of the site, to tell people from bots and keep attacks out. It lives for 30 minutes, tells us nothing about who you are, and is strictly necessary to keep the site reachable, so it needs no consent either.

What we ask consent for

One thing: the pricing table. To show prices in your own currency we ask Paddle, our payment provider, which means loading Paddle’s script and letting Paddle see your IP address to work out which country you are in.

None of that is needed to read the site, so it waits for your answer. Decline and prices stay in US dollars; everything else behaves exactly the same. Until you answer, nothing loads — no answer is treated as no, not as not-yet.

Starting a checkout is different. If you click through to subscribe, Paddle loads because paying is the thing you just asked for. You never have to accept anything here to be able to buy.

Preferences stored on your device

Your theme, language, editor typography and a few reading preferences are kept in your browser’s local storage, not in a cookie. They never leave your device and are never sent to us.

The choice you make on the cookie notice is stored the same way, so the notice does not greet you on every visit.

What we do not do

No advertising cookies. No third-party analytics. No pixels, no fingerprinting, no cross-site tracking, and nothing that follows you off Narrale.

Apart from the price lookup described above, there is nothing else to consent to and nothing running quietly in the background.

Clearing them, and changing your mind

You can delete Narrale’s cookies and local storage from your browser settings at any time, and block them entirely if you prefer. Clearing local storage also clears your cookie answer, so the notice will ask again on your next visit.

Doing so signs you out and resets your preferences to their defaults. Nothing else is affected, and your writing is untouched.