Cookie Policy

1. The short version#

This site sets no advertising cookies, no tracking pixels and nothing that follows you to other websites. What it stores falls into two groups: a small number of cookies without which the site cannot function, and one optional flag recording whether you agreed to anonymous visit statistics.

Under Swiss and EU law, cookies that are strictly necessary to provide a service you asked for do not require your consent — but you are entitled to know about them, which is what this page is for. Everything else is off until you switch it on.

2. Cookies we cannot do without#

These exist to make the site work at all. Refusing them does not make you more private; it makes signing in, staying signed in, and submitting any form impossible.

• __Host-authjs.csrf-token — proves that a form was submitted from this site and not from an attacker’s page. Without it every sign-in and every form is rejected. Expires when you close the browser.
• __Secure-authjs.session-token — keeps you signed in. Set only after you sign in, and removed when you sign out.
• __Secure-authjs.callback-url — remembers the page to return you to after signing in. Expires with the browser session.
• armsma_2fa — carries the pending two-factor step between the password screen and the code screen. Lives about ten minutes.
• NEXT_LOCALE — the language you chose, so the site does not reset to English on every visit. One year.
• armsma_forum_ack_v1 — records that you have read the forum rules, so you are not asked again. One year.
• armsma_analytics — records your answer to the statistics question, so we can honour it server-side and stop asking. One year. It stores your choice, including a refusal.

3. Statistics — only if you agree#

If you accept statistics, we record which page was opened, in which language, and the country the request came from. No IP address is stored, no identifier is set that would let us recognise you on a later visit, and nothing is shared with anyone.

There is no separate analytics cookie: the flag in the list above is the whole mechanism. When it says no, the server discards the page view instead of writing it.

We use no third-party analytics service. There is no Google Analytics, no Meta pixel, no heatmap or session-recording tool on this site.

4. Cookies set by Cloudflare#

Cloudflare sits in front of this site to absorb attacks and to run the anti-bot check on the sign-in and contact forms. In doing so it may set its own cookies — typically __cf_bm, which distinguishes people from automated traffic and lasts about half an hour, and a short-lived cookie while a Turnstile challenge is being solved.

These are security cookies, not advertising ones, and they are strictly necessary in the same sense as the list above: without them the anti-bot protection cannot work. We do not read them and they are not used to profile you.

5. Storage that is not a cookie#

Your cookie choice itself is kept in your browser’s local storage under armsma-cookie-consent, not in a cookie. That is deliberate: refusing cookies should not require setting one. Local storage stays on your device and is never sent to our server.

A few interface conveniences — which tab you last had open, for example — are stored the same way. None of it identifies you, and clearing your browser data removes all of it.

6. Changing your mind#

You can change your answer at any time on this page, using the panel below. Withdrawing consent is as easy as giving it, and takes effect immediately.

You can also delete cookies and block them in your browser’s settings. Blocking the strictly necessary ones will prevent you from signing in and from submitting forms — the site will tell you so rather than failing silently.

7. Changes to this policy#

If we add a cookie, it appears in the list above before it is set, and the date at the top of this page changes. We do not add cookies that require consent without asking you again.