Cookies

Consent is what a site needs before storing something on your device for its own purposes, and above all before advertising or cross site tracking. This site does none of that.

What is kept in your browser is a courtesy limit on the careers form and a one word mark for the visitor count, plus, for our staff and clients alone, the username last used on their sign-in page. None of it is shared with anyone, the first two identify nobody, and the visitor mark only ever stops the site counting you twice. Putting a banner in front of every reader to ask about any of it would be theatre.

If that ever changes, a banner will appear before the thing it is asking about loads, and a refusal will be one click and will work.

One item, holding the times an application was sent from this browser in the last day. Nothing else: not your name, not your answers, not your CV.

It is a courtesy limit rather than a security control. What it is there to stop is a double tapped submit on a slow connection, or the same application arriving five times because nothing appeared to happen. Anybody who wants past it clears it in a keystroke, and it is not trying to stop them.

It never leaves your device. A browser that refuses to store it, a private window for instance, is allowed to send anyway: refusing an honest applicant to enforce a limit that was never a real defence is the wrong trade.

Nothing you type is saved. Reload the page and the form is empty again, because the only thing written down is that list of timestamps.

The site counts its own visitors, to know how many people opened it. The first time a page opens in a browser, the page asks the site for a one time code and sends it straight back; the site adds one to that day's number, and the page keeps a mark in local storage (va.counted) so that browser is never counted again. No cookie is set, and the message itself names neither the page nor where you came from. Your browser does attach the page's address to the request, as it does to every request it makes; the site reads it only to check that the request came from its own pages, and does not store it. To count each browser once a day, the site keeps a scrambled code made from the network address and the browser's name, which cannot be turned back into either, is different every day and is deleted after two days. For a minute at a time it also counts requests per address, under the same kind of code, to turn away floods. What stays is only how many people came each day. With Do Not Track switched on, the page sends nothing at all.

Where it is switched on, Cloudflare Web Analytics also counts page views. It is cookieless: no cookie, no identifier and no fingerprint, and it cannot tell a returning reader from a new one or follow anyone to another site.

There is no Google Analytics, no Meta pixel, no TikTok pixel and no session recording tool anywhere on this site.

Almost nothing. Every typeface, script, stylesheet and image is served from our own domain. The exceptions are:

• Cloudflare's analytics beacon above, on the pages where it is switched on (the visitor count is served from our own domain),
• the WhatsApp links, which are plain links and load nothing until you tap one.

There is no embedded video, no social media widget, no font from a third party and no library from a public network. The staff and admin pages go further and carry a content security policy that refuses any script not on this list; the public pages keep to the list by how they are built.

Your browser's Clear browsing data control removes every item, after which your next visit is counted once more, and a private window keeps nothing between sessions.

A content blocker changes nothing here except the visitor counts. The site and the form work the same afterwards.