Strictly necessary
These keep the site working — they cannot be disabled in our controls.
- accessToken / refreshToken — httpOnly session cookies (1 day / 7 days). Used to keep you signed in. They are readable only by our server, never by scripts running on the page, and we do not keep a copy of either in your browser's local storage.
- ag.consent.v2 — browser storage rather than a cookie. Records the choice you made in the cookie panel so we do not ask again. Kept until you clear it.
- __cf_bm, cf_clearance — set by Cloudflare, which sits in front of this site, to tell humans from bots and to block attacks (30 minutes and up to 1 year respectively). Set by Cloudflare, not by us, and we cannot read their contents.
- Sign-in state — browser storage holding your display name, user ID, role and avatar so a page can render while you are signed in. Cleared when you sign out.
Preferences
- theme — remembers light / dark / system choice. Local storage, never sent to the server.
- ag.checkoutLayout — remembers how you last chose to view the checkout.
- supportChatId, supportWelcomeShown — keep a support conversation attached to you between page loads and stop the welcome message repeating.
- These are set because you asked for something — a theme, a layout, a support chat — and are not used to track you. They stay out of the consent toggles for that reason.
Analytics — only with your consent
We use Google Analytics 4 to understand which guides and species pages are read. It is off until you accept it, and declining it costs you nothing on the site.
- _ga — distinguishes one browser from another so a returning reader is not counted twice (2 years, set by Google).
- _ga_YLB5KS1HLC — keeps the state of the current visit for the same purpose (2 years, set by Google).
We send IP-anonymised, non-personalised hits, and we do not pass your name, email or account ID to Google.
Advertising — only with your consent
No advertising is running on this site at present — no ad slot is configured, so turning this category on sets nothing today. The control and this disclosure exist because the site is built to carry advertising, and the terms are better stated before that happens than after. If a slot is enabled it would be served by a third-party network such as Google AdSense, it would stay off until you accept it, and then:
- Google, as a third-party vendor, uses cookies to serve ads here, which lets it serve ads based on your visits to this and other sites.
- Other companies may also place and read cookies in your browser through those ad slots, or use web beacons to collect information from ads served here. We do not control them. Google publishes the list at its ad technology providers page.
- Typical cookie names are __gads, __gpi and IDE (up to 13 months, set by Google and its partners).
Refusing would not remove ads if any were running — it means they are chosen without your browsing history. You can also turn off personalisation for your Google account at My Ad Center, or opt out across many vendors at aboutads.info.
Changing your mind
Analytics and advertising cookies are denied by default until you answer the banner. To change your answer later, use Cookie choices in the footer of any page — it reopens the banner and your new answer takes effect immediately.
Other third-party content
Embedded content (YouTube videos, OpenStreetMap tiles on the live globe) may set its own cookies when you load a page containing it. We don't control them — refer to each provider's privacy policy. Disabling third-party cookies in your browser will block these embeds.
Managing cookies
Every modern browser lets you view, block, or delete cookies. See your browser's help docs:
- Chrome: Settings → Privacy and security → Cookies
- Firefox: Preferences → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data