Cookie Policy

Refusing is exactly as easy as accepting. The banner you saw on arrival offers Accept and Reject as two buttons of the same size, in the same style, side by side, on the same screen. Neither is hidden behind a second step, and neither is styled to look like the obvious answer.

Nothing beyond strictly necessary cookies is set until you accept. Closing the banner without choosing is treated as a refusal, not as consent.

You can change your answer at any time from the "Cookie choices" link in the footer of every page. Withdrawing consent takes the same single click that giving it did.

A cookie is a small file a site asks your browser to keep. We also use two related technologies — browser storage, which works the same way but is not sent back with every request, and a single-pixel measurement request. Everything in this policy applies to all three, whatever the technical name.

These make the site work. They cannot be switched off, and they do not require consent, because without them the service cannot do what you asked it to.

• a.Session: keeps you signed in as you move between pages. Expires when you sign out, or after 30 days.
• b.Security: guards against cross-site request forgery on forms. Expires with the session.
• c.Load balancing: keeps your requests going to the same server during a generation pass. Expires within the hour.
• d.Cookie choice: records the answer you gave the banner, so we do not ask again. Expires after 12 months.

These tell us which pages are used, which are slow, and where the service breaks. They are set only after you accept.

• a.Page and event counts, aggregated. Expires after 13 months.
• b.Error and performance diagnostics, tied to a random identifier and not to your account. Expires after 90 days.

These remember small choices so you do not have to make them again. They are set only after you accept.

• a.Chosen aspect ratio and last used plan view. Expires after 12 months.
• b.Reduced-motion preference, where you set it in the interface rather than in your operating system. Expires after 12 months.

• a.No advertising cookies.
• b.No cross-site tracking, and no sharing of your activity for behavioural advertising.
• c.No social network embeds that set cookies before you interact with them.
• d.No fingerprinting of your device as a substitute for cookies.

A small number of processors set or read cookies in the course of doing their job. Each is limited to that job:

• a.Our hosting and content delivery provider sets a load-balancing cookie. Strictly necessary.
• b.Our payment provider sets cookies on its own checkout pages, under its own policy, once you are there. Nothing of theirs runs on this site before that point.
• c.Our error monitoring provider sets a diagnostic identifier. Performance category, only after you accept.

If your browser sends a Global Privacy Control signal, we treat it as a refusal of the performance and preference categories, and as an opt-out of any sale or sharing of personal information for the purposes of the California Consumer Privacy Act. You do not need to also use the banner. If you have already accepted and then send the signal, the signal wins.

Every major browser lets you see the cookies a site has set, delete them, and refuse new ones. Blocking strictly necessary cookies will stop you being able to sign in, which is a limitation of how sign-in works rather than a choice we have made.

Email support@gallusprojectsuk.com. This policy forms part of the Pitchface Privacy Policy.

Effective date: 20 August 2026.