Legal
Cookie Notice
This notice describes our current use of cookies and similar technologies.
Effective date: 13 July 2026 · Consent implementation last tested: 16 July 2026 (logged-out browser audit). The effective date is the policy version date; the test date is a technical check and does not change it.
At a glance
- Consent implementation last tested 16 July 2026 (logged-out browser audit): ordinary browsing set no first-party cookies unless analytics was accepted.
- We use Google Analytics 4 (via Google Site Kit) with Google Consent Mode; analytics cookies are denied by default and load only if you accept. We use no advertising, marketing, social or cross-site tracking cookies.
- The only browser storage is functional: a WordPress-core sessionStorage emoji-support flag, plus a localStorage flag written only if you dismiss the privacy notice. Neither is used for tracking.
- A small number of strictly-necessary security cookies may be set only when you submit the pilot form or, for staff, sign in to the admin area.
- The pilot form uses Cloudflare Turnstile anti-bot protection, which may set a cookie on its own domain.
- Analytics is the only non-essential category; it needs your opt-in and you can change your choice at any time on the cookie settings page.
Cookies are small files that a website can store in your browser; “similar technologies” include related mechanisms such as localStorage, indexedDB and sessionStorage. We measured what this site actually stores across a range of states — an anonymous homepage visit, our methodology and legal pages, the pilot form open with Cloudflare Turnstile rendered, and logged-out browsing.
What we actually store. As of our most recent consent-implementation test — a logged-out browser audit on 16 July 2026 — ordinary browsing of seoryx.app set no first-party cookies and wrote no localStorage or indexedDB for a visitor who had not yet made a consent choice. Accepting analytics then sets the two Google Analytics cookies listed below, and records your choice in one functional localStorage flag. The only browser storage we observed anywhere on the site is one WordPress-core functional sessionStorage item, wpEmojiSettingsSupports. It caches the result of a one-off emoji-support test within your browser tab, is not used for tracking, and is cleared when you close the tab. Separately, when you accept or reject analytics in the first-visit privacy notice, we write one functional localStorage flag (seoryx_consent_v1) recording that choice, so we can honour it and not ask again — it stores no personal data and is not used for tracking.
1. Strictly-necessary and security cookies
A limited set of strictly-necessary and security cookies may be set, but only in specific circumstances — never as part of passive browsing. They exist to keep interactions safe and to protect our forms from abuse.
| Technology | Provider | Purpose | When it is set |
|---|---|---|---|
| WordPress and Contact Form 7 (session, form-integrity and nonce cookies) | WordPress.org / Contact Form 7 | Maintain form integrity, validate a submission and protect against cross-site request forgery. | Only when you actively submit the pilot form, or, for our staff, when signing in to the admin area. |
| Cloudflare Turnstile | Cloudflare, Inc. | Anti-bot challenge that protects the pilot form from automated abuse. | When the pilot form is used; Turnstile may set a cookie on its own domain (challenges.cloudflare.com). |
These technologies are essential to the functions above, so they are not subject to consent. We have described their purposes rather than asserting specific cookie names or lifetimes we cannot independently confirm.
2. Analytics and marketing
We use Google Analytics 4 (GA4), provided by Google, loaded through the Google Site Kit plugin, to understand aggregate, non-identifying usage of the site (for example, which pages are viewed). We do not use advertising, marketing, social or cross-site tracking cookies, and ad personalisation and ad storage are disabled.
Google Consent Mode is enabled. For every visitor, worldwide — not only in the UK and EEA — analytics storage is denied by default, so GA4 sets no analytics cookies and receives only cookieless, aggregated signals until you consent. If you select Accept in our banner (or on the Cookie settings page), GA4 may then set these first-party cookies:
| Cookie | Set by | Purpose | Typical duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes visitors | Up to 2 years |
_ga_C5088TRTCW | Google Analytics 4 | Maintains session state for this property | Up to 2 years |
You can accept or reject analytics at any time using the banner or the Cookie settings page; rejecting keeps analytics storage denied. See the Privacy Notice for Google as a processor, international transfers and retention.
3. Managing cookies
Analytics is the only non-essential category. You can accept or reject it in our banner or on the cookie settings page, and change your choice at any time. Rejecting keeps analytics storage denied, so no analytics cookies are set.
You can still block or delete cookies at any time through your browser settings, and you can clear sessionStorage in the same way. If you do, please note that the pilot form’s anti-bot check may not work, which can prevent you from submitting the form.
4. Third-party domains
A small number of requests are made to third-party domains, limited to the following. Only Google Analytics is used for analytics, and only with your consent; none are used for advertising.
- challenges.cloudflare.com
- Cloudflare Turnstile anti-bot challenge on the pilot form. It may set a cookie on its own domain to run the check.
- googletagmanager.com, google-analytics.com
- Google Analytics 4, loaded via Google Site Kit. Analytics cookies are set only if you consent; with consent denied, Google Consent Mode uses cookieless, aggregated signals.
- WordPress.org
- Occasional WordPress-core front-end static assets (for example, emoji resources), loaded only when such assets are actually used.
For more on how we handle personal data and who processes it on our behalf, see our Privacy Notice.