Legal
Cookie notice
Last updated: 21 July 2026
1. The cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| nl_session | Keeps you signed in after you click a sign-in link from your inbox. It holds an opaque token — no personal data is stored in the cookie itself, and the server keeps only a one-way hash of the token. Set only when you sign in. | 30 days, or until you sign out |
| nl_admin | Signs the site operator into the administration panel. It is never set for visitors or for signed-in users — only for the operator, on the admin pages. | 8 hours |
Both cookies are httpOnly, so no script on the page can read them, and both are marked Secure in production, so they are only ever sent over HTTPS. nl_session uses SameSite=Lax and nl_admin uses the stricter SameSite=Strict; neither is sent along with requests originating from other websites in a way that would let anyone track you across sites.
If you have never signed in, this site sets no cookies at all. You can browse the landing page, read these policies and sign up for the digest without one being written.
2. What we do not use
We think it is worth being specific rather than saying “we may use cookies”. We do not use:
- Analytics of any kind — no Google Analytics, no self-hosted analytics, no page-view counting.
- Advertising, retargeting or conversion cookies.
- Tracking pixels or web beacons, including in the emails we send you. We record that an email was sent and whether the provider accepted it; we do not track whether you opened it.
- Third-party embeds, social widgets, chat widgets or CDNs that could set cookies of their own. There are no third-party scripts on this site.
- Browser fingerprinting, local storage or session storage for tracking. The site does not write to either.
- Externally hosted web fonts. Our two typefaces are bundled with the site at build time, so your browser never makes a request to a font provider.
3. Why there is no cookie banner
Swedish law (chapter 9, section 32 of lagen om elektronisk kommunikation, 2022:482, implementing the EU ePrivacy rules) requires your consent before storing information on your device — except where the storage is strictly necessary to provide a service you have explicitly asked for. Keeping you signed in after you asked to be signed in is exactly that exception.
Since both of our cookies are strictly necessary and we run no analytics or advertising, the law requires us to inform you — which is what this page is — but not to ask permission. A consent banner here would be theatre, and clicking one is worse than not being tracked in the first place.
If that ever changes and we introduce a cookie that is not strictly necessary, we will ask for your consent properly, before setting it, and update this page.
4. Controlling cookies
You can block or delete cookies in your browser settings. Blocking nl_session does not stop you receiving your digest — the manage link in every email works without signing in — but you will not be able to stay signed in to the account pages.
More on what we do with personal data, including the email address behind your account, is in the privacy policy.