Cookie Policy
Last updated: September 2026
This page lists every cookie and browser storage item TAP IN HERE uses, and explains why we do not show a cookie consent banner.
Why there is no cookie banner
Under the ePrivacy Directive (and the national laws implementing it), consent is required before storing information on your device unless that storage is strictly necessary to provide the service you asked for. We only store what is strictly necessary, so there is nothing to ask you to consent to.
We use no advertising cookies, no cross-site trackers, and no third-party analytics or marketing tags. Nothing on this site profiles you or follows you to another website.
Cookies we set
| Name | Purpose | Lifetime | Basis |
|---|---|---|---|
tih_session |
Keeps you signed in. HttpOnly, Secure, SameSite=Lax — it cannot be read by JavaScript. | Idle 7 days; maximum 30 days | Strictly necessary |
csrf_token |
Protects against cross-site request forgery: it is echoed back on every state-changing request to prove it came from this site. | 24 hours | Strictly necessary |
Both are first-party. Neither is used to analyse behaviour or build any profile.
Local storage
| Key | Purpose | Lifetime |
|---|---|---|
tih-theme |
Remembers whether you chose light or dark mode. Written only when you click the theme toggle yourself. | Until you clear it |
This never leaves your browser — it is not sent to us and not readable by anyone else.
Analytics, and why it needs no cookie
Profile owners see view, click and scan statistics for their own page. That measurement sets no cookie and stores no identifier on your device at all. It also never records your IP address.
Visitors are counted server-side using a truncated hash of the page, IP, browser and a salt that changes every day, so the same person on two different days produces two unrelated values. That makes a daily unique-visitor count possible while making it impossible to follow anyone across days. Every number an owner sees is aggregated; no owner can see an individual visitor.
Third parties
Two third parties can receive a request from your browser:
- Cloudflare Turnstile — our bot check on sign-up, sign-in and review submission. It is a privacy-preserving CAPTCHA alternative that does not track users across sites.
- Google Fonts — serves the site's typefaces.
Payment pages are hosted by PayU, which applies its own cookie policy once you go there to pay.
Controlling cookies
You can clear or block cookies in your browser settings. Because the two cookies above are strictly necessary, blocking them will stop you signing in or submitting forms — the site's public pages will still be readable.
Questions
Email [email protected]. See also our Privacy Policy.