Cookies

These make the site work. There is no way to turn them off and still have an account.

Signing you in. Four cookies from the library that handles sign-in. One keeps you signed in and lasts 30 days from the last time you used the site. One remembers where to send you back to after signing in. One protects the sign-in form from being submitted by another site. One lasts fifteen minutes and only exists while you are signing in with Google. None of them can be read by any code running in the page.

Remembering how you left things. Whether the site is in dark or light, which layout your collection was in, whether you finished setting up, whether your collection is empty, and which language to look things up in. These last a year, except the layout ones, which last 30 days.

Not asking you the same thing twice. Whether you have dismissed the feature-wish card, for 90 days, and whether you have dismissed the check, for 30 days.

Your answer about cookies, kept for a year, so we do not ask again every time you arrive.

Dark or light is in this list rather than the next one, deliberately. It is written the moment a page draws, before anybody could have answered a banner, because the alternative is a white flash on a dark screen for everybody who has not answered yet.

We use Google Analytics to see which pages people use and where they get stuck. It writes two cookies that last two years: one named _ga and one named after our own measurement id.

If you refuse, or have not answered, the script is never added to the page and neither cookie is written. Nothing is held back until later and nothing is queued up to send if you change your mind.

If you accept and later change your mind, use the Cookies link at the foot of any page.

If we run an ad, we would like to know whether anybody came from it. That is Meta's pixel, and it is a separate question from analytics because it is a different company and a different purpose: Meta is an advertising network, and it can connect your visit to your Facebook or Instagram account.

It writes two cookies that last 90 days. One named _fbp, which identifies your browser to Meta, and one named _fbc, which is written only if you arrived by pressing one of our ads and holds the id of that press.

All it reports is that you arrived. We do not tell Meta that you made an account, or what is on your shelf, or your email address, and we send no event when you do anything in the app.

What those two cookies carry goes to Meta, and Meta decides what to do with it. Our agreement is with Meta's Irish company, and we read that to mean the trip to the United States is theirs to make rather than ours. The Privacy Policy says why that is the reading we take rather than a settled question, and where to go for the part Meta answers for.

If you refuse, or have not answered, the script is never added to the page and neither cookie is written. If you accept and later change your mind, use the Cookies link at the foot of any page: that stops the pixel and deletes both cookies.

One cookie is none of the three above, and it is the only one here written before you have answered anything. It is called signup-source and it lasts 30 days.

It remembers which link brought you here - the name of the site or post, and nothing about you - so we can tell which ones are worth writing. It is written only when you arrive on a link we tagged ourselves, which is the kind we put in a post or an ad; arrive any other way and nothing is written at all. It holds that one name, like producthunt, and nothing else: no identifier, no record of which pages you read, nothing about you. It is written once and never changed, so it cannot build up a history of your visits.

Nothing outside mySpoils reads it. We read it once, at the moment an account is created, to record which link that account arrived on, and never again.

Why it does not wait for your answer. Gating it would mean our count of which links are worth writing only ever described the people who accepted a banner, which is not a count of anything. It carries nothing about you, so there is nothing for a yes or a no to protect. If you would rather not have it, deleting cookies in your browser clears it like any other.

Three preferences are stored in your browser rather than sent to us. They never leave your device.

Which years you have folded away in the timeline. Which layout your collection was in, which is the same value as the cookie above rather than a second preference. And whether you have closed the suggestion to put mySpoils on your home screen.

One honest note about the second. If you follow somebody's link to a particular layout, that becomes your saved layout, without you having pressed anything.

And one about the third. If your browser blocks storage entirely, we treat you as having already dismissed that suggestion, so you are never asked. That is the same outcome as closing it.

Three things load from another company, and only when you press:

• A video, from YouTube. We use their privacy-enhanced address, which holds cookie data back until a video actually plays.
• A book preview, from Google.
• A map, from Google.

Each is a request to that company. If you are signed in to Google, it carries your Google cookies, and they can set more. You are told this where the press is, before anything loads. If you never press, none of it happens.

Pictures on a spoil, posters, covers, sleeves and logos, are fetched by your browser from whoever holds them. That is described in the Privacy Policy.

The Cookies link at the foot of every page reopens the choice. Refusing after having accepted stops anything further being collected; what Google or Meta already holds is covered by their own policies.

You can also delete cookies in your browser's settings, which will sign you out and lose the preferences above.