Cookies

What we set

• Session cookie — set when you sign in, so the site knows it is you. HttpOnly, Secure, SameSite=Lax. Removed when you sign out.
• Security cookies — short-lived values used to protect sign-in and form submissions against cross-site attacks.

That is the entire list for the core service. We do not set analytics cookies: our own analytics is cookie-free and uses a salted visitor hash that rotates daily.

Advertising cookies

When advertising is enabled on editorial pages, Google AdSense may set its own cookies and identifiers under Google’s policies. You can control this through your Google ad settings, and browser-level controls apply as well. Advertising is never present in the mail product.

Turning them off

Every browser lets you block or delete cookies. Blocking our session cookie will stop you being able to sign in, because that is the cookie that keeps you signed in. Browsing the publication without signing in works fine with cookies blocked.