Cookies and device storage
What Project Universal and its partners may store on your device, including the Google ads and privacy choices used on the website.
Choose how your data is used
Necessary storage keeps the site secure and remembers your choices. On pages with Google AdSense, Google’s privacy message lets UK, EEA and Swiss visitors accept, refuse or manage advertising purposes and optional analytics. Refusing consent does not prevent you from reading Project Universal; an ad may still be shown where Google can serve it under your choice.
What this service stores
“Cookies” below also covers comparable browser and app technologies, including local storage, Cache Storage, service workers and push subscriptions.
Project Universal analytics choice
- Names
project-universal-cookie-consentandproject-universal-cookie-consent-token- Purpose
- Remembers whether analytics was accepted or declined on pages where Google’s consent message is not active, and links that choice to a server-side consent record.
- Duration
- Up to 180 days, unless reset or cleared sooner.
- Provider
- Project Universal
Google consent message
- Technology
- Google’s consent management platform and the IAB Transparency and Consent Framework (TCF) choice signal. Google and participating vendors may use cookies or similar storage to remember and honour the purposes you selected.
- Purpose
- Records your advertising and analytics preferences, communicates them to relevant vendors, and lets you change them later.
- Duration
- Until the choice expires, you change it, or you clear site data; individual identifiers and vendor retention periods can differ.
- Provider
- Google and the vendors listed in the privacy message’s “Manage options” screen.
Session security, sign-in and protected forms
- Names
- The PHP session cookie when a session is active, and
project_universal_csrfwhere no session is active. - Purpose
- Supports sign-in, account and admin access, checkout state, password flows and anti-forgery protection for forms.
- Duration
- Normally the browser session. An authenticated website session may be extended for up to 30 days. In the installed app, a secure sign-in token lasts for up to 400 days at a time and is renewed while the app is used; it ends sooner after logout, a password-security change or clearing the app’s data.
- Provider
- Project Universal and its hosting environment
Display, navigation and install preferences
- Technology
- Theme cookie and local storage; short-lived session storage for “back to top”; install-state and install-prompt preferences.
- Purpose
- Remembers a display choice, completes requested navigation and avoids repeatedly showing an app-install prompt after “Not now”.
- Duration
- Theme choice up to one year; navigation flag for the session; install prompt suppression for 14 days; installed-state until browser data is cleared.
- Provider
- Project Universal
PWA service worker and offline cache
- Technology
- Service worker and browser Cache Storage.
- Purpose
- Keeps the app shell, styles, scripts, icons, an offline page and a limited recent-image cache available for faster or offline use.
- Duration
- Until replaced by a newer cache version, removed by the service worker, the app is uninstalled, or site data is cleared.
- Provider
- Project Universal, stored on your device
Phone and PWA notifications
- Technology
- Browser notification permission, PushManager subscription and local prompt preferences.
- Purpose
- Delivers alerts only after you choose Enable and grant device permission. The server stores the subscription endpoint and encryption keys needed for delivery.
- Duration
- Until notifications are disabled or the subscription expires. Choosing “Not now” hides the prompt for seven days.
- Provider
- Project Universal and the push service operated by the browser or device provider
Google Analytics 4
- Names
- Google Analytics identifiers such as
_gaand_ga_<container-id>. - Purpose
- Measures page use, broad device class, PWA adoption and selected engagement events so the service can be improved.
- Duration
- Set only after acceptance; Google Analytics identifiers may last up to two years, subject to the configured retention and browser controls.
- Provider
- Google Analytics (measurement ID
G-CNCRGL0BC0)
Google AdSense and ad partners
- Technology
- Ad requests, cookies, pixels, IP addresses and other browser or device identifiers. Examples of Google advertising cookies include
__gpiand cookies associated with Google advertising domains; the actual names depend on browser, region and ad delivery. - Purpose
- Displays and measures ads, limits repetition, protects against invalid traffic and, only where allowed by your choices, personalises advertising using prior activity.
- Where
- AdSense code is used on pages other than the homepage when the site’s sidebar ad is enabled. An ad placement appears below the opening countdown in the sidebar.
- Duration
- Varies by cookie, vendor, browser and your settings. See the live vendor list in “Manage options” and the provider policies linked below.
- Provider
- Google AdSense and eligible advertising partners.
Notification engagement analytics
- Names
project-universal-notification-visitorin local storage and a short-lived notification session in session storage.- Purpose
- Distinguishes new and returning anonymous browsers after an email or phone-notification visit, and measures source, page views, active reading time and scroll depth.
- Duration
- Set only after analytics acceptance. The browser identifier lasts until browser data is cleared; the visit attribution expires after 30 minutes. Server-side engagement records are retained for up to 400 days.
- Provider
- Project Universal. Stored records contain hashed random identifiers, not names, email addresses, account IDs, raw identifiers or IP addresses.
AdSense, consent and your choices
Project Universal uses Google AdSense for the sidebar advertising on interior pages. The homepage does not load the AdSense tag. Google and other advertising vendors can receive technical information when an ad request is made, even if no ad appears in the space.
What an ad request can involve
Google and eligible ad partners may process your IP address, browser and device details, page and ad activity, and cookies or similar identifiers. Third-party vendors may place or read cookies, or use pixels and IP addresses, when ads are served. Google explains this in How AdSense uses cookies and How Google uses information from partner sites.
Personalised and other ads
If you consent, Google and participating vendors may use earlier visits to this or other websites to select personalised ads. Without that consent, an available ad may instead use the page’s subject or broad location, or Google may be unable to serve one. Non-personalised ads can still involve limited storage for purposes such as frequency capping, reporting and fraud prevention where permitted.
The Google privacy message
For visitors in the UK, EEA and Switzerland, Google’s consent message offers “Do not consent”, “Consent” and “Manage options”. “Manage options” lists the purposes and current vendors, including where a vendor relies on legitimate interests. Your choice is passed to participating vendors through the TCF signal. Optional Google Analytics follows the analytics choice rather than the ad choice alone.
Change or withdraw a choice
Use here or the Privacy settings link in the footer to reopen the controls. You can also manage Google’s own ad personalisation in Google Ad Settings and clear stored data in your browser. Changing a choice affects future processing; it does not remove data already held by a provider.
Media, security and delivery providers
Cloudflare Turnstile
Anti-abuse checks protect sign-in, comments, contact and subscription forms. Cloudflare may process device and network signals and use necessary storage to distinguish people from automated abuse. The check is used for security, not advertising.
Spotify and YouTube
Podcast and video pages can load embedded players from Spotify and YouTube. Opening a page containing a player can send technical information such as an IP address and browser details to that provider. YouTube embeds use its privacy-enhanced domain where available.
Push services
Apple, Google, Mozilla, Microsoft or another browser provider may route a requested push alert to the device. Their handling is governed by the provider and device settings as well as the choices available on this site.
How the controls are intended to work
Consent is a real choice
Optional analytics is denied by default. Google’s message separates consent from refusal and provides detailed purpose and vendor controls. The public service remains available if you refuse advertising or analytics consent.
Necessary means necessary
Essential storage is limited to security, authentication, a service or preference you explicitly requested, and remembering the consent decision itself. It is not used for behavioural advertising.
You can change your mind
Use the privacy control near the top of this page or the footer’s Privacy settings link at any time. You can also clear cookies, local storage, site permissions and cached data through browser or device settings. Clearing session data may sign you out.
Applicable framework
The controls are designed around the UK Privacy and Electronic Communications Regulations and UK GDPR, including the ICO’s current storage and access guidance, and the comparable ePrivacy and GDPR consent requirements for visitors in the EEA.
Ask about your data
Use the contact page for a question about storage, consent or personal data. Project Universal will review this notice when a provider or feature changes; the date above shows the latest full review.
