Cookie Policy

Cookies are small files a website stores in your browser. Similar technologies include browser (web) storage, IndexedDB databases, service workers, tracking pixels, scripts and tags that read information from your device, link tracking and device fingerprinting. The law (the Privacy and Electronic Communications Regulations, PECR) applies to all of them: a website must tell you about them and, unless an exception applies, get your consent before storing or reading information on your device.

This policy explains what FamFusion, run by Q25 LTD, uses. It is based on a check of both our code and the live website, including what is actually stored in the browser and every network request made by our pages.

When you browse the homepage, the Journal, articles and our information pages (including this one), FamFusion:

• sets no cookies;
• stores nothing in local storage, session storage or IndexedDB;
• registers no service worker and creates no offline caches;
• loads everything from famfusion.co.uk itself, with no third-party scripts, fonts, pixels, analytics, advertising or embedded videos or maps;
• uses no fingerprinting, and adds no tracking parameters to ordinary links. Affiliate links are the one exception: they carry FamFusion's identifier for the retailer, as explained below.

Like any website, your browser keeps its own ordinary cache of pages and images we send so they load faster. That is controlled by your browser, strictly necessary for delivering the content you ask for, and does not track you.

Our hosting provider processes technical request information (such as your IP address) to deliver and protect the site. That does not involve storing anything on your device; it is explained in our Privacy Policy.

Links in articles can take you to other websites. When we link out, we tell your browser not to send those sites the address of the FamFusion page you were reading. Once you arrive, their own cookie policies apply.

Some articles may contain affiliate links, which are labelled as such, to retailers such as Amazon. FamFusion stores nothing on your device when you see or click one. The link's web address contains FamFusion's affiliate identifier so that the retailer can credit us.

Once you arrive on the retailer's website, that website (for example amazon.co.uk) may set its own cookies, including to record that you came from FamFusion. Those are the retailer's cookies, not ours: they are set on the retailer's website under its own cookie notice and choices, and we cannot read or control them.

Our private Admin area is used only by invited members of the FamFusion editorial team. Signing in, and a small number of sign-in addresses, use the following. All are first party (set by FamFusion itself), none is used for tracking, analytics or advertising, and none is shared with anyone else.

• __Secure-authjs.session-token

  Type

  Cookie, first party (FamFusion (Auth.js sign-in library))

  Used by

  Admin staff only

  Purpose

  Keeps a signed-in member of the FamFusion editorial team signed in to the Admin area and proves to the server who they are on each request.

  Information

  An encrypted token containing the account identifier, name and email address. HttpOnly, Secure, SameSite=Lax; not readable by page scripts. Very large tokens may be split into numbered parts (…session-token.0, .1).

  Duration

  Up to 30 days after last activity (renewed at most once a day while in use); deleted on sign-out. (persistent)

  Legal basis for storing it

  Strictly necessary exception (PECR): no consent needed.

• __Host-authjs.csrf-token

  Type

  Cookie, first party (FamFusion (Auth.js sign-in library))

  Used by

  Anyone using a sign-in endpoint

  Purpose

  Protects sign-in and sign-out requests against cross-site request forgery.

  Information

  A random value and its hash. Contains no personal information about the visitor. HttpOnly, Secure, SameSite=Lax.

  Duration

  Until the browser is closed. (session)

  Legal basis for storing it

  Strictly necessary exception (PECR): no consent needed.

• __Secure-authjs.callback-url

  Type

  Cookie, first party (FamFusion (Auth.js sign-in library))

  Used by

  Anyone using a sign-in endpoint

  Purpose

  Remembers which FamFusion page to return to after signing in or out.

  Information

  A FamFusion web address. HttpOnly, Secure, SameSite=Lax.

  Duration

  Until the browser is closed. (session)

  Legal basis for storing it

  Strictly necessary exception (PECR): no consent needed.

• famfusion-blog-backup:{article}

  Type

  Local storage, first party (FamFusion)

  Used by

  Admin staff only

  Purpose

  Keeps a local recovery copy of an article being edited in the Admin editor so unsaved work is not lost if the connection or browser fails. Offered back to the editor, never applied silently. An older key format (famfusion-blog-{article}) is read once and deleted.

  Information

  The draft article's fields (title, text, image references, metadata) and the time of the copy. Stays in the editor's browser; it is not sent anywhere by being stored.

  Duration

  Until the draft is saved to the server or discarded, or the editor clears their browser storage. (persistent)

  Legal basis for storing it

  Strictly necessary exception (PECR): no consent needed.

Where these involve personal information (the session cookie and the editor recovery copy), our lawful basis under UK GDPR is legitimate interests in keeping the Admin area secure and protecting editorial work. See our Privacy Policy.

PECR allows storage and access without consent where it is strictly necessary to provide an online service someone has asked for, including security and signing in. Everything listed above falls within that exception, and none of it is used on the public pages you read.

We could show a banner anyway, but asking you to accept or reject cookies that do not exist would be misleading and would get in the way. Affiliate links do not change this, because FamFusion itself stores nothing when you use them. If we ever want to use something that needs your consent, such as analytics or display advertising, we will ask first, give you an equally clear way to say no, set nothing non-essential until you choose, and let you change your mind at any time as easily as you gave consent.

• Analytics or statistics tools (including Google Analytics and Vercel Web Analytics).
• Display advertising, retargeting or affiliate cookies set by FamFusion (retailers may set their own cookies on their own websites; see Affiliate links).
• Social media pixels, share buttons or embedded posts.
• Third-party fonts, scripts, videos or maps.
• Consent-management platforms (because no consent-requiring technologies are in use).
• Device fingerprinting or cross-site tracking of any kind.

You can see and delete cookies and site data at any time in your browser's settings, and you can block cookies entirely. Blocking cookies will not affect reading FamFusion. It will stop the Admin sign-in from working, because signing in depends on the session and security cookies.

The ICO explains more about cookies and how to control them at ico.org.uk/for-the-public/online/cookies.

We update this policy before we introduce or change any cookie or similar technology. New features, such as future FamFusion accounts, may need new essential cookies, which we will list here. Anything that requires consent will not be used until you have given it. The version history records each change.

Questions: email info@q25.co.uk.