Tier 1: counting visits, no consent needed
This runs for everybody, including people who refuse the cookie. It stores nothing on your computer or phone: no cookie, no local storage, no session storage, no database in your browser, no fingerprint. UK privacy law (the Privacy and Electronic Communications Regulations, regulation 6) requires consent before a website stores information on your device or reads information back off it. This tier does neither, so there is nothing here to consent to.
Your visit adds one to a set of daily running totals. Some of them move on every page you open, and some move only once for the whole visit:
| What | Example | Counted |
|---|---|---|
| Which page was loaded | /blog.html | every page |
| The words on a link or button you clicked | Get Started | every click |
| Which site linked you here, and which channel that is | google.com → Organic: Google | once a visit |
| Campaign tags in the link, if the link carried any | utm_campaign=autumn | once a visit |
| The town and country the connection came from | Canterbury, GB | once a visit |
| Whether the screen is phone, tablet or desktop sized | mobile | once a visit |
| How long the visit lasted, and how many pages it covered | 2 pages, 1m 40s | once a visit |
| How many different devices visited today | 18 | once a day |
| Which blog post was opened, and how many different devices opened it today | /blog/house-socks-explained | every view, and once a day |
| If you are in a private shop: which shop, and how far you got in it | The King’s School: opened, looked, basket | every view, and once a visit |
Nothing new is recorded about you here. The right-hand column only says how often each existing total moves, and moving less often means fewer numbers about your visit, not more.
These are totals, not a list of visits. There is no record anywhere of one person's path through the site. The database holds numbers like “41 page views on 14 September, across 18 visits, 6 of them on a phone”. It does not hold rows, and it cannot be unpicked back into rows.
The one exception, and it is a short-lived one, is how we avoid counting the same reader twice. To say “nine different devices read that post yesterday” we have to remember, for the length of the day, that a device has already been counted for that post. So alongside the totals there is a scratch list of one-way codes, each paired with the post it belongs to. It is not a reading history and it cannot become one: no browser can read it, nothing is stored beside it (no time, no address, no visit), the secret that made each code is destroyed every 24 hours, and the list itself is deleted within 48. Its only job is to stop a total being wrong.
If you open a private shop
Some of our customers get a private shop of their own, opened with a passphrase or a direct link we sent them. We count how those shops are used, so we can tell whether a shop we set up for somebody is actually being opened: how many times it was opened, how many different devices opened it that day, and how far people got: opened it, looked at a product, put a pair in the basket, went to pay, paid.
These are totals about the shop, not about you. There is no record anywhere of which visitor looked at which customer’s shop: no list, no log, no row. The database holds numbers like “that shop was opened 4 times on 14 September by 2 different devices, and one order was placed”.
Your passphrase and your link are never sent to the counter, and are never written down by it, in any form. What identifies the shop to our counter is the temporary token the shop itself gave your browser when you got in, and even that is only used to look the shop up on our server, in the same instant, and is then thrown away. It is not stored and it is not logged.
The same short-lived scratch list described above is used here, so that the same device is not counted twice in one day for one shop. It holds a one-way code paired with the shop, nothing beside it, and it is deleted on the same 48-hour schedule.
Your IP address, and the one thing we do with it
Your IP address arrives with your request, because it must for the internet to work. We use it inside that single request for two things (working out the town and country to count, and stopping one machine from flooding the counter) and then it is gone. It is never written down: not in full, not shortened, not scrambled into a code, and not in a log. It is also never sent to anybody else: the town is worked out on our own server from a database we host ourselves, not by asking a geolocation company, precisely so that your address does not leave us.
For the daily “how many different devices” number we make a one-way code from your address and browser type using a secret that changes every 24 hours and is destroyed when it changes. The codes themselves are deleted after 48 hours. Once that secret is gone the code cannot be linked back to an address by anyone, including us, which is why this number can tell us “eighteen devices today” and can never tell us “this person was also here yesterday”.
Our lawful basis for tier 1 under the UK GDPR is legitimate interests, Article 6(1)(f): a small business needs to know whether its own website works. We have written that assessment down, including the balancing test, in our internal documentation.
Tier 2: the optional cookie
If, and only if, you click Accept, we set one first-party cookie called ss_vid. It contains a random identifier we generate. It holds no name, no email address, nothing you have typed, and nothing derived from your device.
What it buys is one number: monthly unique visitors. Without something that survives from one day to the next, we can count visits but cannot tell whether twenty visits were twenty people or one person twenty times. The cookie also lets us tell a first-time visitor from a returning one, and it lets us count how many different people read each blog post in a month, which is the same question asked about one post instead of the whole site. It is not used for advertising, is not shared, and works only on this site. If you open a private shop, it lets us count how many different people opened that shop in a month in the same way, and the scratch list behind that figure is deleted as soon as the month ends, exactly like the one for blog posts.
Counting that also needs a scratch list, for the same reason and with the same limits. It holds one code per reader per post per month, the codes are one-way and are not the identifier in your cookie, no browser can read them, and the list is deleted as soon as the month it covers has ended. Once a month is over the count for it can never change again, so keeping the list that produced it would serve no purpose. The count stays; the list does not.
Our lawful basis for tier 2 is your consent, and consent is the basis for both storing the cookie (PECR reg. 6) and using what it produces (UK GDPR Art. 6(1)(a)). Because the monthly figure covers only people who accepted, we also record how many visitors were asked and how many said yes, so that the number is always read next to the share of traffic it represents.
| Cookie | What it holds | How long | Why it is allowed |
|---|---|---|---|
ss_consent | Your answer: accepted or rejected | 13 months | Strictly necessary to honour your own choice (PECR reg. 6(4)) |
ss_vid | A random identifier | 13 months | Your consent, given only when you click Accept |
ss_noanalytics | The flag that switches counting off | 10 years | Strictly necessary to carry out your own request |
If you open a private shop with a passphrase we gave you, that shop puts a token in your browser so you stay signed in while you shop. It is strictly necessary for the thing you just asked for, and it is exempt for that reason. It is not an advertising or tracking identifier, it means nothing on any other site, and it is gone when you close the tab. It is also what tells our counter which shop you are in, as described above. The counter looks the shop up from it and throws it away, and neither the token nor your passphrase is ever stored by it.
Who is on the site right now
We keep a live count of how many tabs have the site open at this moment, so we can see interest during a campaign. Each open tab gets a random number that exists only in that tab's memory while the page is open, never written to your device, and the entry is removed by our database the instant the connection drops, whether you close the tab, close the laptop or lose signal. Nothing records that it ever existed.
How long everything is kept
| What | Kept for | Then |
|---|---|---|
| Daily totals (pages, channels, towns, devices, clicks) | 25 months | Deleted automatically. Two full years, so we can compare a September with the September before it, plus the month we are in. |
| The monthly list of random cookie identifiers | 14 months | Deleted automatically. The cookie itself only lasts 13 months, so past this the list can tell us nothing a live cookie would. |
| The 24-hour codes behind “different devices today”, and the same codes paired with a blog post or a private shop | 48 hours | Deleted automatically, together, and the secret that made them is already destroyed. |
| The codes behind “different people read this post this month”, and the same codes paired with a private shop | Until the month ends | Deleted automatically within 48 hours of the month closing, together. The counts they produced are kept on the 14-month schedule above; the codes are not. |
| The live “on the site now” entry | Not kept | Removed when your connection ends. |
Every one of those deletions is performed by a job that runs every night, and again opportunistically if a night is ever missed. They are limits a program enforces, not intentions.
What we never collect
- Your IP address, in any stored form, in either tier.
- Your browser's user agent string, your exact screen size, or any fingerprint.
- Anything you type. There is no listener on any form field anywhere on this site: we record the words printed on a link or button you click, never the contents of a box you fill in.
- What you searched for. If a search engine sends you here we can see that it did; the part of the address that carries your search terms is discarded before anything is recorded.
- Anything at all about you on other websites. Nothing here follows you anywhere.