Cookie policy
The main joke does not set cookies. The optional contact form on joke.scot uses one essential PHP session cookie.
Cookies used by this release
Reading ai.scot, si.scot or joke.scot does not itself set cookies through the supplied page code. When you open joke.scot/contact.php, the PHP form starts a session and sets an essential session cookie (PHPSESSID, unless renamed in server configuration). This cookie allows the form's CSRF token and anti-abuse protections to work. It is configured as HttpOnly, SameSite=Lax and Secure when HTTPS is correctly detected. It is a browser-session cookie; your browser may retain it until the session ends.
What about hosting or security cookies?
A hosting provider, content-delivery network or security service could set its own cookies or similar technologies even when they do not appear in the website's HTML. The operator must check the live sites, including their responses and third-party services, and update this policy if any are found.
Why isn't there a cookie banner?
We have not added marketing or analytics tracking. The contact form's strictly necessary security session cookie is used only to provide the contact form you request, so a decorative "accept all" banner would be misleading. If we introduce non-exempt cookies later, this policy and any required consent controls must be updated first.
Server logs aren't cookies
The web server may record IP addresses, requested paths, times, referrers and browser identifiers for security and operations. Those records are addressed in the privacy notice rather than a cookie preference panel.
Links to external charity websites
Clicking an official donation link opens the charity's own website, which may use its own essential or optional cookies. We don't embed payment widgets or donation trackers on our pages. Other external links, including image credits and source material, are subject to the destination's own cookie practices.
If this changes
Before adding analytics, embedded social content, advertising or a third-party sharing widget, the operator will review this policy and assess whether consent or another permitted mechanism is required under the current rules. Last drafted: 3 October 2026.