Cookie policy
The browser storage this website uses and why it is needed.
Last updated: September 27, 2026
Current use
We currently use only strictly necessary cookies for administrator authentication and security. They are created when an administrator starts or completes Google sign-in. The public market pages do not require these cookies, and we do not currently use analytics, personalisation or advertising cookies.
Necessary cookies
| Name | Purpose | Duration |
|---|---|---|
ontons_google_state | Protects the Google sign-in redirect against request forgery. | Up to 10 minutes |
ontons_admin_session | Keeps an authorised administrator signed in securely. | Configured session period; 24 hours by default |
Both cookies are inaccessible to browser scripts and use SameSite protection. In production over HTTPS, they are also marked Secure.
Notice preference
Your browser stores ontons_cookie_notice_v1 locally after you acknowledge the notice. This value records only that necessary-cookie information was shown and the time of acknowledgement. Local storage is not sent to the server with web requests.
Managing browser data
You can delete cookies and local storage in your browser settings. Doing so may sign an administrator out and will make the cookie notice appear again. If optional cookies are introduced in the future, they will be disabled until an appropriate choice is made and this policy will be updated.