Cookies and device storage
A plain-English record of the cookies and similar technologies used by Project Universal on the website, mobile layout and installed app.
Optional analytics is off until you accept
Declining analytics does not restrict articles, guides, video, podcast or account access. Essential storage remains available only where it is needed to deliver a feature, remember a choice you made, or protect the service.
What this service stores
“Cookies” below also covers comparable browser and app technologies, including local storage, Cache Storage, service workers and push subscriptions.
Consent choice and consent record
- Names
project-universal-cookie-consentandproject-universal-cookie-consent-token- Purpose
- Remembers whether analytics was accepted or declined and links that choice to a server-side consent record.
- Duration
- Up to 180 days, unless reset or cleared sooner.
- Provider
- Project Universal
Session security, sign-in and protected forms
- Names
- The PHP session cookie when a session is active, and
project_universal_csrfwhere no session is active. - Purpose
- Supports sign-in, account and admin access, checkout state, password flows and anti-forgery protection for forms.
- Duration
- Normally the browser session. An authenticated session may be extended for up to 30 days while the account remains signed in.
- Provider
- Project Universal and its hosting environment
Display, navigation and install preferences
- Technology
- Theme cookie and local storage; short-lived session storage for “back to top”; install-state and install-prompt preferences.
- Purpose
- Remembers a display choice, completes requested navigation and avoids repeatedly showing an app-install prompt after “Not now”.
- Duration
- Theme choice up to one year; navigation flag for the session; install prompt suppression for 14 days; installed-state until browser data is cleared.
- Provider
- Project Universal
PWA service worker and offline cache
- Technology
- Service worker and browser Cache Storage.
- Purpose
- Keeps the app shell, styles, scripts, icons, an offline page and a limited recent-image cache available for faster or offline use.
- Duration
- Until replaced by a newer cache version, removed by the service worker, the app is uninstalled, or site data is cleared.
- Provider
- Project Universal, stored on your device
Phone and PWA notifications
- Technology
- Browser notification permission, PushManager subscription and local prompt preferences.
- Purpose
- Delivers alerts only after you choose Enable and grant device permission. The server stores the subscription endpoint and encryption keys needed for delivery.
- Duration
- Until notifications are disabled or the subscription expires. Choosing “Not now” hides the prompt for seven days.
- Provider
- Project Universal and the push service operated by the browser or device provider
Google Analytics 4
- Names
- Google Analytics identifiers such as
_gaand_ga_<container-id>. - Purpose
- Measures page use, broad device class, PWA adoption and selected engagement events so the service can be improved.
- Duration
- Set only after acceptance; Google Analytics identifiers may last up to two years, subject to the configured retention and browser controls.
- Provider
- Google Analytics (measurement ID
G-CNCRGL0BC0)
Media, security and delivery providers
Cloudflare Turnstile
Anti-abuse checks protect sign-in, comments, contact and subscription forms. Cloudflare may process device and network signals and use necessary storage to distinguish people from automated abuse. The check is used for security, not advertising.
Spotify and YouTube
Podcast and video pages can load embedded players from Spotify and YouTube. Opening a page containing a player can send technical information such as an IP address and browser details to that provider. YouTube embeds use its privacy-enhanced domain where available.
Push services
Apple, Google, Mozilla, Microsoft or another browser provider may route a requested push alert to the device. Their handling is governed by the provider and device settings as well as the choices available on this site.
How the controls are intended to work
Consent is a real choice
Non-essential analytics remains denied by default. Accept and Decline are separate actions, there are no pre-ticked choices, and the public service remains available if analytics is declined.
Necessary means necessary
Essential storage is limited to security, authentication, a service or preference you explicitly requested, and remembering the consent decision itself. It is not used for behavioural advertising.
You can change your mind
Use “Review cookie choices” above at any time. You can also clear Project Universal’s cookies, local storage, site permissions and cached data through browser or device settings. Clearing session data may sign you out.
Applicable framework
The controls are designed around the UK Privacy and Electronic Communications Regulations and UK GDPR, including the ICO’s current storage and access guidance, and the comparable ePrivacy and GDPR consent requirements for visitors in the EEA.
Ask about your data
Use the contact page for a question about storage, consent or personal data. Project Universal will review this notice when a provider or feature changes; the date above shows the latest full review.