Cookies

Consent is what a site needs before storing something on your device for its own purposes, and above all before advertising or cross site tracking. This site does none of that.

What is kept in your browser is a courtesy limit on the careers form and one item for the visit count, plus, for our staff and clients alone, the username last used on their sign-in page. None of it is shared with anyone, the first two identify nobody, and the visit count's item only ever stops the site counting you or a visit twice. Putting a banner in front of every reader to ask about any of it would be theatre.

If that ever changes, a banner will appear before the thing it is asking about loads, and a refusal will be one click and will work.

One item, holding the times an application was sent from this browser in the last day. Nothing else: not your name, not your answers, not your CV.

It is a courtesy limit rather than a security control. What it is there to stop is a double tapped submit on a slow connection, or the same application arriving five times because nothing appeared to happen. Anybody who wants past it clears it in a keystroke, and it is not trying to stop them.

It never leaves your device. A browser that refuses to store it, a private window for instance, is allowed to send anyway: refusing an honest applicant to enforce a limit that was never a real defence is the wrong trade.

Nothing you type is saved. Reload the page and the form is empty again, because the only thing written down is that list of timestamps.

The site counts its own visits, to know how many people opened it, how they found it and what they read, and keeps only totals for each day: how many people came and how many visits, which pages were opened, the site or app a visit came from (its name only, such as Google or Instagram, and the campaign word if the link carried one), the country, the kind of device, the browser, system and language, how long pages stayed on screen, which links were tapped (WhatsApp, email, social), whether the careers form was sent, and how fast the pages showed. A visit sends two short messages to the site, one as it starts and one as you leave, and nothing about the visit itself is kept once its numbers are added in. No cookie is set.

The page keeps one item in local storage (va): the day this browser was last counted, with a random code for that day (a new one every day), whether it has come back before, and the visit in progress (when it started, where it came from, the pages opened, the time spent and the links tapped), so a person counts once a day and a visit once. To count each browser once a day, the site keeps a scrambled code made from the network address, the browser's name and a random code the page picks for that day, which cannot be turned back into any of them, is different every day and is deleted after two days. For a minute at a time it also counts requests per address, under the same kind of code, to turn away floods. With Do Not Track switched on, the page sends nothing at all.

Where it is switched on, Cloudflare Web Analytics also counts page views. It is cookieless: no cookie, no identifier and no fingerprint, and it cannot tell a returning reader from a new one or follow anyone to another site.

There is no Google Analytics, no Meta pixel, no TikTok pixel and no session recording tool anywhere on this site.

Almost nothing. Every typeface, script, stylesheet and image is served from our own domain. The exceptions are:

• Cloudflare's analytics beacon above, on the pages where it is switched on (the visit count is served from our own domain),
• the WhatsApp links, which are plain links and load nothing until you tap one.

There is no embedded video, no social media widget, no font from a third party and no library from a public network. The staff and admin pages go further and carry a content security policy that refuses any script not on this list; the public pages keep to the list by how they are built.

Your browser's Clear browsing data control removes every item, after which your next visit is counted once more, and a private window keeps nothing between sessions.

A content blocker changes nothing here except the visit counts. The site and the form work the same afterwards.