Cookie Policy

This policy explains how Buried Beneath Vault uses cookies and similar browser technologies. It describes the technologies actually deployed, not generic advertising or analytics tools that are not in use.

This is the current inventory for the published Buried Beneath Vault site. Every item below is strictly necessary for a function you have asked for, so none of it requires consent under the UK cookie rules.

• __cf_bm — a Cloudflare cookie used to distinguish humans from bots and protect the site from automated abuse. Set by Cloudflare, short-lived. Strictly necessary (security).
• __dpl — a hosting cookie that keeps your browser talking to the correct deployment of the site. Strictly necessary (technical delivery).
• Sign-in session storage — our authentication provider stores your session and refresh tokens in browser storage so you stay signed in and your private Vault content can be requested securely. Strictly necessary (authentication).
• Scroll-position session storage — the app records where you were on a page so the position is restored when you move back and forward. Cleared when the tab closes. Strictly necessary (basic functionality).
• bbv-cookie-consent — local storage recording your response to the cookie notice, so we do not show it again. Strictly necessary (recording your preference).
• Stripe — when you continue to a Stripe-hosted checkout or billing page, Stripe sets its own cookies and storage on those pages for secure payment and fraud prevention. Those are controlled by Stripe under its own notices.
• Platform web font — a font file used by our hosting platform's on-page badge is requested from cdn.gpteng.co. It is a font download only: it sets no cookie, writes nothing to your device storage and performs no tracking.

Map tiles from Ordnance Survey (served through our own server) and Esri satellite imagery are ordinary image requests and do not set cookies for us. Your browser may cache map images normally.

The live service uses no analytics, advertising, social-media, profiling or cross-site tracking technology. We do not deploy Google Analytics, Meta Pixel or similar tools, and we set no IndexedDB store or advertising identifier.

If Buried Beneath Vault ever introduces a non-essential technology, it will not be loaded before valid consent is given, and this inventory will be updated first.

You can use available cookie controls and your browser settings to remove or block cookies. Blocking strictly necessary technologies may prevent sign-in, checkout or other core functions.

If optional cookies are added, the service should provide an appropriate consent/control mechanism before they are activated where required.

The live application's cookie and local-storage inventory should be reviewed whenever new analytics, advertising, embedded media or tracking functionality is introduced. This policy will be updated accordingly.