Cookie and Storage Statement ============================ Tillyard. Version 1.4. In effect from October 22, 2026. Fingerprint of this text (SHA-256): 3f47241bd3491aa42848bbac0f135f5cba7c48ac97b6580b0ae12412ec266724 This version: https://tillyard.org/policies/cookie-and-storage-statement/v/1.4 - The site sets a small number of its own cookies: one that keeps you signed in, a few short-lived ones for joining, signing in and safety, one that lets us tell you about a sign-in from a new browser, one that holds your unread-note count for 90 seconds, and two that remember choices you made. - There are no advertising cookies, no analytics cookies, no cross-site cookies of ours and no fingerprinting. That is why the site shows no cookie banner today: nothing optional is being set that we would need to ask you about. The banner is built and switched off, and it comes on before any analytics or advertising is added. - "Your privacy choices", in the footer of every page, opens three groups: needed to run the site (always on), analytics and advertising. The last two stay off until you allow them, and a browser that sends Global Privacy Control is treated as saying no to advertising. - Our own code sets no cookie when you simply read a public page. Our network provider, Cloudflare, may add a short-lived security cookie (section 4). - One outside component runs in your browser: the Cloudflare Turnstile bot check, and only on forms that send email or accept input from people who are not signed in. - The résumé tools keep your work in your own browser, not on our servers, unless you ask for an account copy. The details you type into a letter template in The Almanac are kept in your browser too, and are never sent to us. - You can clear all of it from your browser at any time. The one thing you cannot do without a cookie is stay signed in. If this summary and the full text below ever differ, the full text governs. 1. What this statement covers ============================= 1.1 What this statement covers ------------------------------ This statement covers everything the Tillyard website keeps in, or reads from, your browser: cookies, local storage, the browser database the Workbench uses, and short-lived page state. It applies to everyone who opens the site, with or without an account. Tillyard is an Ohio nonprofit corporation. "We" and "us" mean Tillyard. 1.2 How it fits with other documents ------------------------------------ The Privacy Notice is the general statement of what we collect and why. For cookies and browser storage this statement is the more specific document, and it governs. Section 37.5 of the Terms of Use sets the order among all our documents, including the sections of those terms that prevail over every other document. How long server-side records are kept is in the Data Retention Schedule. 1.3 Words used here ------------------- Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word. - A cookie is a small piece of text a website asks your browser to keep and send back with later requests. - First-party means set by the site you are visiting, for that site alone. Third-party means set by, or readable by, some other company. - Local storage is a small store in your browser that a site's own scripts can read and write. It is not sent to the site automatically. - IndexedDB is a larger database inside your browser, used here by the Workbench to hold your documents on your device. - Essential means the site, or the feature you asked for, cannot work without it. - A keyed hash is a one-way scramble made with a secret key that only our servers hold. 2. Our approach =============== - We set a cookie only when something you did needs one: signing in, starting to join, submitting a form, changing a display setting, or asking for a directory search pass. There is one exception: once you are signed in, signed-in pages set a 90-second cookie that holds your count of unread notes, so the count can be shown without a database read. - Every cookie we set is first-party. None is shared with, or readable by, another company. - Today no cookie or stored item is used to follow you across other websites, to build an advertising profile, or to measure you for analytics. If any of that is added, it sits in a group you can say no to (section 3.3). - We keep identifiers out of anything that does not need one. The display-settings cookie, for example, holds settings and no identifier. - The site loads no third-party script, font, image, pixel or social widget, with the single exception in section 5. 3. Cookies the site sets ======================== Cookies the site sets. Columns: cookie, what it is for, when it is set, how long it lasts, what it holds, kind. Cookie | What it is for | When it is set | How long it lasts | What it holds | Kind ------------------------------------------------------------------------------ Sign-in cookie, __Host-sid | Keeps you signed in as you move from page to page, and when you open a room or a notes connection | When you sign in | Until you sign out. Otherwise up to 180 days, or 60 days without use, whichever comes first | A long random token. No name, no email address, nothing readable. Our servers hold only a scrambled copy to match it against | Essential Demo cookie, __Host-demo | Keeps you in the demo you opened, on demo.tillyard.org only, and lets us count your visit without knowing who you are. The demo copy also sets its own sign-in cookie for the invented guest account | When you open a demo link | Until the demo link closes, 30 days at most | A signed random id for your visit and which link it was. Nothing about you | Essential Preview-code cookie, __Host-preview | Remembers that you typed the preview code while the site is not open yet, so you are not asked again | When you type a right code on the coming-soon page | 30 days | A signed note that the code was right, and which code. Nothing about you | Essential Demo-view cookie, __Host-persona | Marks a browser where the owner of the site is looking at the site as a demo account | When the owner switches to a demo view in the console | Two hours at most, or until the owner returns to their own account | A signed note naming the owner and the demo account. It does not sign anyone in | Essential Joining cookie, __Host-jn | Carries your answers from one step of joining to the next | While you are joining | One hour at most. It is removed when you finish | Your name, your college address and which steps are done, encrypted. Never your date of birth | Essential Sign-in code cookie, __Host-si | Ties a sign-in code to the browser that asked for it | When you ask for a sign-in code | About 15 minutes | The address you typed and a random value, encrypted | Essential Passkey cookie, __Host-wa | Holds the one-time challenge while your device answers with a passkey | When you use or add a passkey | 5 minutes | A random challenge, encrypted | Essential Second-step cookie, __Host-ts | Remembers, for a few minutes, that you have finished the first step of a two-step sign-in and still owe the second | When you sign in with two-step sign-in turned on | 15 minutes. It is removed when you finish | Which account, a random value and the time, encrypted | Essential Two-step set-up cookie, __Host-tp | Holds the key for your authenticator app until you have typed in the first code that proves it works | When you set up two-step sign-in | 15 minutes. It is removed when you finish | A random key, encrypted | Essential Recovery-codes cookie, __Host-rc | Shows your new recovery codes once | When you make recovery codes | 10 minutes. It is removed when you say you have saved them | The codes, encrypted | Essential Refusal cookie, __Host-rf | Stops the sign-up questions being asked again straight away after a sign-up was declined in this browser | When a sign-up is declined | Up to 30 days | The day until which the form stays closed in this browser, encrypted. No birth date, no name, no email address | Essential Device cookie, __Host-dv | Lets us tell you when your account is used from a browser it has not been used from before | When you sign in | 400 days | A random value. Nothing about you | Essential Unread-count cookie, nu | Shows your unread count without a database read | On signed-in pages | 90 seconds | A count, a time and a signature. No identifier | Essential Message cookie, __Host-flash | Shows a one-time confirmation after you submit a form, such as "Profile saved." | When a form you submitted sends you back to a page | Until the message is shown, and never more than 2 minutes | The short message, signed so nobody else can put words in the site's mouth | Essential Display-settings cookie, ui | Applies your reading and display settings (text size, reduced movement, paused live pages, sounds, single-key shortcuts, time style, clock and theme) on this device, signed in or not | When you change a setting under "Reading and motion", and when you sign in | 400 days from the last change | A short settings code. No identifier of any kind | Set at your request Privacy-choices cookie, privacy | Remembers what you chose in the cookie banner or the privacy choices panel, so you are not asked on every page | When you make a choice | 180 days, then you are asked again | Which optional groups you allowed, written like v1.analytics or v1.none. Nothing about you | Set at your request Search-pass cookie, dirpass | Lets a signed-out visitor make a small number of directory searches after one bot check | When a signed-out visitor presses "Continue to search". Only if signed-out search is switched on | 10 minutes | A signed pass, tied to a keyed hash of your IP address, with a count of searches used | Essential for that feature 3.1 How these cookies are protected ----------------------------------- - The sign-in, joining, sign-in code, passkey, recovery-codes, refusal, device, unread-count, message and search-pass cookies are marked so that scripts running in the page cannot read them. - The whole site is served over an encrypted connection. Cookies whose names begin __Host- can only ever be sent over one, and are bound to this exact site address: no other address, including any other part of our own domain, can set or read them. - The privacy-choices cookie is the one exception to that first rule: the page's own script has to read it to know what you chose, so scripts can see it. It holds nothing about you. - All of them are marked so that they are not sent along with requests that start from another website and try to change something here. - We reject any request that tries to change something from another site, whatever cookies it carries. 3.2 Cookies we do not set ------------------------- Our own code sets no cookie when you read the front page, an explainer, a published paper, a record page or a policy page without signing in. No cookie records which pages you viewed. Section 4 covers the security cookies our network provider may add. 3.3 Your privacy choices ------------------------ The site is set up to ask before it uses anything it does not need in order to run. Cookies and the like fall into three groups: - Needed to run the site. Always on. These are the cookies in the table above that keep you signed in, hold your display settings and protect forms. - Analytics. Counts visits so we can see which pages get used. Off unless you allow it. The site uses none today. - Advertising. Shows or measures ads, including on other sites. Off unless you allow it. The site uses none today. Where the banner is on, it sits at the bottom of the page with Accept all, Reject all and Choose, and nothing in the last two groups loads until you pick. It is off today because there is nothing to ask about. It comes on by itself the moment an analytics or advertising tag is added to the site, so nothing of that kind can load unasked. "Your privacy choices", in the footer of every page, opens the same choices whenever you like, banner or no banner. Your answer is kept in the privacy cookie for 180 days, and then we ask again. If you take back a choice, the cookies that group set are cleared and the page reloads. A Global Privacy Control signal from your browser is treated as a no to advertising. The advertising switch stays off, the panel says so, and the cookie never records advertising as allowed while the signal is on. Analytics still follows your choice. Pages you see while signed in, and the sign-in, joining, reporting, removal and safety pages, load no analytics and no advertising, whatever you chose. 4. Cookies our network provider may set ======================================= The site is delivered through Cloudflare's network. Depending on which of Cloudflare's protections are switched on, Cloudflare may set a security cookie of its own on our address: Cookies our network provider may set. Columns: cookie, set by, what it is for, how long it lasts. Cookie | Set by | What it is for | How long it lasts ---------------------------------------------------- __cf_bm | Cloudflare's bot protection, if switched on | Helps Cloudflare tell automated traffic from people | Expires after 30 minutes without activity cf_clearance | Cloudflare's challenge page, if a visitor is shown one | Records that the challenge was completed so it is not shown again on every page | Set by Cloudflare Cloudflare describes both as strictly necessary security cookies. Neither is used for advertising. The staff console is part of the site, at tillyard.org/staff. Staff use the site's own sign-in cookie, and our network provider sets no sign-in cookie for it. 5. The bot check ================ 5.1 Where it appears -------------------- Forms that send an email or accept input from someone who is not signed in sit behind Cloudflare Turnstile. That includes joining, asking for a sign-in or check code, changing your school email, looking up a record by its code, the directory search pass, the dispute and correction form, the removal request form, the larger-support inquiry form and an outside confirmer's form. It does not appear on ordinary pages. 5.2 What it does ---------------- On those forms, your browser loads a small script from Cloudflare, which runs inside a frame served by Cloudflare. Cloudflare says it looks at these signals to tell people from scripts: your IP address, technical details of your connection, your browser type, and which site the check is on. Cloudflare says the purpose is not to identify, profile or target anyone, and that it also uses the signals to improve its bot detection. The check gives your browser a single-use token that lasts a few minutes. Your browser sends it with the form, our server asks Cloudflare whether it is good, and we receive a yes or a no. We keep that result for the one request and nothing else. 5.3 Storage ----------- In the way we use it, Turnstile sets no cookie on our address. Its frame belongs to Cloudflare and may keep its own short-lived state inside that frame, under Cloudflare's control and its own privacy terms. 5.4 If you cannot complete it ----------------------------- The check is meant to work with a keyboard and a screen reader. If it does not work for you, write to accessibility@tillyard.org. Requests that the law gives you a right to make, such as a removal request or a copyright notice, can always be sent by email or post instead; the addresses are in the policy for each. 6. Storage in your browser ========================== Some things are kept in your browser and never sent to us unless you ask. Storage in your browser. Columns: item, kind of storage, what it is for, what it holds, how long it stays, sent to our servers? Item | Kind of storage | What it is for | What it holds | How long it stays | Sent to our servers? ------------------------------------------------------------------------------ almanac.me | Local storage | Fills the letter and email templates in The Almanac with your own details | The name, school, year and field you typed | Until you press "Forget these", sign out or close your account, or you clear it | No. It is never sent to us wb- (the Workbench database: the name is wb- followed by your member identifier) | IndexedDB | Holds the work you do with the résumé tools on this device | Your résumés, letters, stories, pitch, checklist and applications tracker; up to 20 named snapshots of each résumé; practice timer sessions and practice reads; and settings for this device (whether it is your own or shared, your copy choices, the day of your last backup) | Until you clear it, or your browser clears it | Only if you switch on account copies, and then only the documents or the tracker, as you choose. Practice results are never sent wb.device | Local storage | Remembers whether you said this is your own device, and which Workbench databases this browser holds, so they can be cleared at sign-out | Your answer (own device or shared computer) and the names of those databases. No document text | Until you clear the Workbench's data or your browser's site data | No wb.session | Storage that lasts only for the tab | Holds your Workbench drafts for one tab on a shared computer, so that nothing is left behind | The documents you worked on in that tab | Until the tab is closed or you sign out | No theme | Local storage | Remembers a light or dark theme chosen with the switch in the header | The word light or dark | Until you change it or clear your browser's storage | No live-paused | Local storage | Remembers that you paused live updates | A single mark | Until you resume or clear your browser's storage | No hold-until | Storage that lasts only for the tab | Holds notices back until a pot you are in the middle of has poured | A time | Until the pot pours or the tab is closed | No Short-lived page state | Memory, or storage that lasts only for the tab | Things like a chat line you have started typing | Only what is on the page | Until you close the tab | Only when you press send or save 6.1 Your own device, or a shared one ------------------------------------ The first time you open the Workbench it asks whether this is your own device. - Your own device. The Workbench creates its database and asks your browser to treat it as storage worth keeping, so the browser is less likely to clear it when space runs low. Your browser may ask you to allow this. - A shared computer. Nothing is written to the browser at all. Your work is held in memory for that tab only, a notice stays on the page to say so, and everything is gone when the tab closes. When you sign out on a device with a Workbench database, the sign-out page offers to clear it. 6.2 Files you import -------------------- If you bring in a résumé as a PDF or Word file, the file is read inside your browser. It is not uploaded, and its contents are released from memory once the text has been pulled out. Only the entries you confirm are saved, and they are saved to the browser database above. 6.3 Things that store nothing ----------------------------- - Tabs of the same browser keep in step with each other using the browser's own messaging between tabs. Nothing is written to storage for this and nothing is sent to us. - The site has no service worker and keeps no offline copy of pages. - A print or "save as PDF" uses your browser's own print dialog. Nothing is stored by us. 6.4 Browsers can clear storage ------------------------------ Browsers sometimes clear stored data by themselves, for example when space is low, after a period without visiting a site, or when a private window closes. Work kept only in the Workbench database can be lost that way. Keep a backup file from "Where your work is kept", or switch on account copies, if the work matters to you. 7. What we do not use ===================== The site uses none of the following today. The first two are the groups in section 3.3: if either is ever added, it loads only after you allow it. - Advertising or retargeting cookies. - Analytics or measurement scripts, including ones described as privacy-friendly. - Third-party cookies of any kind. - Tracking pixels, in pages or in email. - Click-tracking links in email. - Browser or device fingerprinting. - Session replay, heat maps or recordings of what you do on a page. - Social-media buttons or embedded content that reports back to another company. - Fonts, images or scripts loaded from other companies' servers. Our fonts are served from our own address. - Link previews. Links in member text are shown as text and the site never fetches them. - Identifiers that persist after you clear your cookies and site data. 8. Browser privacy signals ========================== Some browsers can send a "Do Not Track" or Global Privacy Control signal. We do not track you across sites, sell your information or share it for advertising, so today there is nothing for the signal to switch off, and the site behaves the same with or without it. If advertising is ever added, a Global Privacy Control signal is treated as a no to it (section 3.3). The Privacy Notice says more. 9. Managing and clearing ======================== 9.1 From inside the site ------------------------ - Sign out. Removes the sign-in cookie from this browser and ends that session on our servers. - Devices. Under "Sign-in and school email" you can see every device that is signed in and sign any of them out. - Reading and motion. Change or reset your display settings. - Theme. Choosing "System" on the theme switch removes the stored theme. - Privacy choices. "Your privacy choices", in the footer of every page, shows what you chose and lets you change it. - Workbench. "Clear this browser's Workbench data" is under "Where your work is kept" and under "Your data" in your account. Make a backup file first if you want to keep the work. 9.2 From your browser --------------------- Every browser lets you see and delete the cookies and stored data for a single site, usually under Settings, then Privacy, then site data. Clearing the data for tillyard.org: - signs you out in that browser; - resets your display settings and theme on that device; - deletes everything the Workbench has stored in that browser. If you have not switched on account copies or kept a backup file, that work cannot be recovered. We do not have it. Clearing your browser does not delete anything held on our servers. To do that, use your account (the Privacy Notice explains how). 9.3 If you block cookies ------------------------ - You can still read every public page. - You cannot sign in or join, because the sign-in cookie and the short-lived joining, sign-in code and passkey cookies are essential. - Your display settings will not be remembered between visits, though your device's own light or dark and reduced-motion preferences are still respected. - Confirmation messages after a form may not appear, though the form will still have been submitted. 9.4 Private windows ------------------- In a private or incognito window, cookies and storage last only until the window closes. You can sign in and work normally, but Workbench documents saved only in that window are lost when it closes. Use shared-computer mode, account copies or a backup file. 10. Other websites ================== - Stripe. Once Tillyard can accept donations, tips and gifts are paid on Stripe's own pages. Those pages are Stripe's and use Stripe's cookies under Stripe's cookie policy. No Stripe script runs on our pages and no Stripe cookie is set on our address. - Links out. Other links you follow from the site, such as a DOI, a LinkedIn address or an opportunity listing, take you to sites with their own cookies. We add no tracking codes to those links. - Outside calls. If a table's opener pastes a link to a video call, the call service's own cookies and policies apply once you follow it. 11. Email ========= Email from Tillyard contains no tracking pixel, no remote image and no click-tracking link, so opening or clicking it sets nothing and reports nothing. Links in email go straight to the site. 12. Changes to this document ============================ We update this statement whenever the site starts or stops using a cookie or a stored item, and change the version and effective date at the top. Earlier versions stay available. A cookie for advertising, analytics or anything else that is not essential or set by your own action is asked about first, in the banner and panel described in section 3.3. 13. Contact =========== - Questions about this statement: legal@tillyard.org - Help with your account or with clearing data: support@tillyard.org - If something here does not work with your assistive technology: accessibility@tillyard.org - Post: Tillyard, 10602 York Rd SW, Etna, Ohio 43062