| Name | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
| csrftoken | IARO (first party) | Stops other sites submitting IARO forms in your browser. | One year | Necessary. Secure, SameSite=Lax. |
| sessionid | IARO (first party) | Keeps you signed in after member login. Not set until you sign in. | 12 hours of inactivity, or when you sign out | Necessary. HttpOnly, Secure when served over HTTPS, SameSite=Lax. |
Cloudflare cookies (for example __cf_bm or similar) | Cloudflare | May be set by the CDN that delivers the site, to distinguish people from automated traffic. | Follows Cloudflare’s current periods, typically under 30 minutes for bot-management cookies | Necessary for delivery and security when Cloudflare is in use. |
_GRECAPTCHA and other Google cookies | Google (third party) | Set by Google reCAPTCHA on the contact, join and Express subscribe forms. Usually this is the invisible v3 score; the same cookies are used if a v2 “I’m not a robot” box is shown. | Follows Google’s current periods (the reCAPTCHA cookie is typically up to six months) | Necessary for those forms. Not used for advertising by IARO. |
The site counts page views on its own server. That needs no cookie and stores nothing on your device, so there is nothing to accept or reject; the Privacy Notice describes what is recorded. If we later add embedded video or other optional tools that set cookies, those will not load until you have a clear Accept or Reject choice. None are installed today.
Read the Privacy Notice for the rest of IARO’s processing.