Cookies and similar technologies
Cookie policy
1. Summary
Hamsterra, operated by Cat and box LLP, sets only cookies that are strictly necessary to sign you in, keep guest access to your advance review copies working and protect sign-in flows. We do not use analytics, advertising or social media cookies, and we do not store anything else in your browser. Strictly necessary cookies do not need consent under the UK Privacy and Electronic Communications Regulations (PECR), so Hamsterra does not show a cookie banner.
If we ever want to use a cookie that is not strictly necessary, we will update this policy and ask for your consent first.
2. Cookies Hamsterra sets
All of these are first-party cookies set by hamsterra.com. They are HttpOnly (not
readable by scripts), SameSite=Lax and sent only over HTTPS. Each holds random values,
signed or checked against a record on our servers; none contains your name or email address.
| Name | Purpose | Sent to | Lifetime |
|---|---|---|---|
__Host-hamsterra_session | Keeps you signed in to your account. | All pages | 30 days, or until you sign out |
__Secure-hamsterra_guest | Opens your guest participation after you follow an emailed access link, without putting the link in the address bar. | /access pages | Up to 30 days, never longer than the link it came from |
__Secure-hamsterra_auth_continue | Lets you finish “Create account” after your email code was checked. | /auth pages | 10 minutes |
__Secure-hamsterra_google | Protects “Continue with Google” against forged requests (it holds the one-time state, nonce and verifier for that sign-in). | /auth/google | 10 minutes |
__Secure-hamsterra_google_link | Ties a Google sign-in that still needs an email code to the browser that started it. | /auth pages | Up to 20 minutes |
__Secure-hamsterra_google_signup | Keeps a new “Continue with Google” account waiting while you accept the terms on the confirmation page. | /auth/google/confirm | 10 minutes |
Until 21 November 2026 your browser may also hold these cookies without the __Host- or __Secure- prefix; we read them the same way, and signing out deletes both.
3. Third-party services
Security check (Cloudflare Turnstile)
The create-account, sign-in code, forgotten-password, campaign application, free book request
and group giveaway forms, and the help form for visitors who are not signed in, include
Cloudflare Turnstile, a check that tells people from automated abuse. It loads from challenges.cloudflare.com and processes signals such as your IP address, browser user agent and TLS fingerprint to detect
bots. Cloudflare says it does not use these signals to identify, profile or target you, and that they
are strictly necessary to detect and block bots. The check runs only on these forms, which could otherwise
be abused to send unwanted email or create fake accounts, so it is part of the service you ask for
when you submit one.
Turnstile sets no cookie on hamsterra.com. Anything it stores on Cloudflare's own domain, challenges.cloudflare.com, is set by Cloudflare and governed by Cloudflare's Turnstile privacy addendum, not by Hamsterra.
Google sign-in
If you choose “Continue with Google”, you are sent to Google to sign in. Google may set its own cookies on its own domains while you do; those are governed by Google's Privacy Policy. When you come back, the only cookies on Hamsterra are the ones listed above.
Our hosting provider
Hamsterra runs on Cloudflare. When Cloudflare's network security needs to check that traffic is not automated, for example during an attack, it may set one of these cookies on hamsterra.com. Cloudflare classes them as strictly necessary, and they contain no name or email address.
| Name | Purpose | Lifetime |
|---|---|---|
__cf_bm | Tells people from bots, so that automated traffic can be blocked. | 30 minutes after your last request |
cf_clearance | Remembers that your browser passed a Cloudflare security challenge. | The challenge passage period, 30 minutes by default |
Cloudflare describes these cookies in its cookie documentation.
4. Controlling cookies
You can block or delete cookies in your browser settings. If you block the cookies above you
will not be able to sign in, finish creating an account or open guest access from an email link,
but public pages will still work. Signing out deletes __Host-hamsterra_session.
5. Contact
Questions about cookies: support@hamsterra.com, or Cat and box LLP, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. See also the Privacy policy.