What a cookie actually is
A cookie is a tiny piece of text a website asks your browser to keep on your device, so it can read it back later. Cookies are usually used to remember that you are signed in, to hold a shopping basket together, or to count visitors.
Some are needed for a site to work at all. Some watch how people move around a site. Some follow people across the wider internet to sell them things. They are not the same thing at all, so this page keeps them apart.
What this site uses now
Today this site is mostly pictures and videos of two very wrinkly brothers, a contact form, a newsletter signup and an arcade. It carries no advertising, and there is nothing here set up to follow you to other websites.
- No advertising cookies. There is no advertising.
- Two analytics cookies, and only if you agree to be counted. Until you press yes they do not exist, and if you never press yes they never exist. They are named below.
- No account cookie, because there is no account. The basket is real but it is not a cookie: it is a single value kept in your browser holding which items you picked and how many, and it is in the table below. Paying happens on a page Stripe serves, so whatever cookies a card payment needs are set by Stripe on Stripe's own site rather than by this one.
- Beyond those two, no cookies at all. There are some small values kept in your browser by a different mechanism called local storage: the arcade games remember your scores and your sound setting, and one more holds your answer about being counted. Every one of them is listed below.
The site is hosted on Cloudflare. Messages and newsletter signups are saved in a Cloudflare database. Our email goes out through a company called Resend, from info@potatoandhash.com. Sending an email does not put anything on your device.
Cloudflare has security features that store something on a visitor's device, and none of them appear to be switched on here. The live site was checked on 8 August 2026, both forms included, and not one reply carried a cookie. That is a dashboard setting rather than anything in the code, so it is checked rather than assumed, and it will be checked again.
The bot check on our forms
The contact form and the newsletter signup are protected by Cloudflare Turnstile. Its job is to tell a person apart from a script, which is what keeps the inbox usable. It is one of two pieces of another company's code that run in your browser here. The other is the analytics tag, which is described further down this page.
Turnstile looks at signals from your browser to make that decision. Whether it stores anything on your device while doing so is Cloudflare's behaviour rather than ours, and Cloudflare's own documentation is the authority on it.
Owner suppliedA check of what Cloudflare Turnstile stores in the browser for this site, so this section can say it exactly rather than describe it in general. Until that is done, nothing specific is claimed.
No advertising. No profile of you. No cookie until you say yes.
Cookies this site sets
These, and not one of them is written until you have said yes to being counted. The site asks once, the answer starts as no, and a visitor who ignores the question never gets any of them.
- _ga, set by Google Analytics. Tells one browser apart from another so two visits from you are not counted as two people. It holds a random number and nothing else about you. Lasts two years. It does not exist in your browser until you agree to be counted.
- _ga_137QPQL5NY, set by Google Analytics. Keeps the state of your current visit for this particular site, so moving between pages is one session rather than several. Lasts two years. It does not exist in your browser until you agree to be counted.
Nothing else on this site sets a cookie of its own. That is checked by searching the whole source for every way of setting one, rather than assumed.
What this site keeps in your browser
Not cookies, and worth being precise about. A few small values are kept in your own browser, using local storage. They are readable only by this site and none of them identifies you: there is no visitor number and nothing that could recognise you on a second visit. Most of them belong to the two arcade games and are never sent anywhere. One of them is your answer to the question about counting visits, and it is the reason you are only asked once.
- ph.zoomies.best. Your highest score in Zoomies, so the results screen can tell you whether you have beaten it. Until you clear it, or clear your browser data.
- ph.zoomies.sound. Whether you turned the sound on or off in Zoomies, so it does not ask again. Until you clear it, or clear your browser data.
- ph.zoomies.flags. Which of the hidden things in Zoomies you have found, so it does not congratulate you twice for the same one. Until you clear it, or clear your browser data.
- ph.zoomies.plays. How many runs of Zoomies you have played, used only to decide whether your first ever run should be announced as a record. Until you clear it, or clear your browser data.
- ph.rush.best. Your highest score in Wrinkle Rush. The two games keep separate records, because they are separate games. Until you clear it, or clear your browser data.
- ph.rush.sound. Whether you turned the sound on or off in Wrinkle Rush. Until you clear it, or clear your browser data.
- ph.rush.plays. How many runs of Wrinkle Rush you have played, used for the same one purpose as the Zoomies count. Until you clear it, or clear your browser data.
- ph.consent.analytics. Your answer to the question about counting visits. It holds one word, either granted or denied, and it is the reason you are only asked once. It is not an identifier and it cannot be used to recognise you. Until you change your answer, or clear your browser data.
- ph.cart. Your basket, as a list of which item and how many. No price, no name, no address, and nothing that could identify you. It is why the basket is still there when you come back, and it is the reason shopping here needs no account and sets no cookie. Until you buy, empty it yourself, or clear your browser data.
Each game page carries its own button that deletes what that game saved. Both games are linked from the arcade, and clearing one game leaves the other alone. Your answer about being counted is not one of them: you change that with the button on the cookie page, because that is where the question lives. Clearing your browser data removes the lot in one go.
Cookies our host sets
Also none. The site is hosted by Cloudflare, and some of their security features do store something on a visitor's device, so this page used to say that two of them might appear here.
It has since been checked against the live site rather than guessed at. Every page was requested, including both forms, and not one of them sent a cookie back. Checked on 8 August 2026.
If that ever changes, these are the two that would show up, so you know what you are looking at: __cf_bm (tells automated traffic apart from people) and cf_clearance (records that a challenge has already been passed, so it is not shown again).
The bot check, and what it is not
Two pieces of somebody else's code run on this site. One is the analytics tag, which sets the cookies named above and only counts you if you said yes. The other is the bot check on the two forms, which is Cloudflare's. It loads inside its own frame, so anything it stores belongs to Cloudflare in Cloudflare's own context rather than to this site, and it is there to tell a person apart from a script. It is not analytics, it is not advertising, and it is not following you anywhere.
Analytics
This site uses Google Analytics to count visits. It went in on 9 August 2026 and this page was rewritten the same day, because until then it said there was no analytics here and that had stopped being true.
No analytics cookie is set until you press yes. The tag loads with analytics storage refused, and every kind of advertising storage refused alongside it, everywhere in the world rather than only where a law says so. It stays refused until you answer the question in the bar at the foot of the page, or use the control further down here. Ignoring the bar is the same as saying no. Nothing is stored, nothing about your visit is counted, and the site behaves in exactly the same way.
They are called _ga and _ga_137QPQL5NY, and Google Analytics is what sets them. Each of them lasts two years. What each one does is written out in the list a little further up this page, next to everything else this site keeps in your browser.
If you do say yes, Google is told which pages you looked at, what kind of device and browser you used, and roughly where you are, which Google works out from your address at the level of a country and usually a city. We never see your full address at any point. What we get back is counts and charts, not a list of people.
If you say no, or say nothing at all, the tag is still loaded onto the page from Google. That is worth saying plainly rather than leaving you to find it. It writes no cookie, your visit is not counted, and the only thing it sends is the fact that the answer is no. Asking Google for that file does mean your browser gives their servers its own address, which is what a browser does with any server it asks for anything.
There is no advertising in any of this. No ad networks, no retargeting, no conversion pixels. Every advertising feature of the analytics account is switched off, and the ad click identifiers are stripped out of anything the tag sends, so nothing measured here can be used to advertise to you anywhere else.
One more thing is kept in your browser, and it is not a cookie. Your answer is saved under ph.consent.analytics, and it holds a single word: granted or denied. That word is the only reason you are asked once rather than on every page. It is not an identifier, it cannot be used to recognise you, and it is never sent anywhere.
If you ignore the bar, nothing at all is written down, so there is nothing to remember your silence and the question comes back next time. Analytics stays off throughout.
Your answer, and changing it
Your answer belongs to this browser on this device, because it is stored here rather than on our side. Answer differently in another browser and that one gets its own answer. Clear your browsing data and the answer goes with it, and you will be asked again.
This part of the page needs scripting, and scripting is not running in this browser, so there is no control here to press. Nothing is being counted either. The analytics tag needs scripting just as much, so no cookie of ours can be set in this browser at all.
Switching it off stops anything further about your visit being counted, straight away and without reloading. A cookie that was already set stays in your browser until it expires or you remove it, and the steps under taking control in your browser remove it.
What the shop turned out to need
The shop is open, and none of the cookies a shop normally needs were among the things it needed. Customer accounts and personalised video requests are still planned and neither exists yet. If either arrives, some cookies become strictly necessary, meaning the feature simply cannot work without them.
- Staying signed in. A cookie remembers it is still you as you move from page to page. Without it you would be signed out on every click. There is nothing to sign in to here, so there is no such cookie.
- Holding your basket. Most shops use a cookie for this. Ours keeps a single value in local storage instead, which is in the table above, so your basket survives a reload without a cookie and without an account.
- Payment safety. Payments are handled by Stripe, which sets its own cookies during checkout to spot fraud and keep the payment step working. Those are set on the pages Stripe serves rather than on this site. Card numbers go straight to Stripe. This site never sees them.
- Form safety. So that a form you submit is the one you filled in, and not something sent on your behalf. Nothing here sets one, which is why the list above says no cookies beyond the analytics pair.
Strictly necessary cookies do not follow you around other websites and are not used for advertising. Because the feature cannot run without them, they are not something we could offer as a choice. Your choice is whether to use that feature at all.
What this site does not do
- It does not sell your information.
- It does not build an advertising profile about you.
- It does not use cookies to track you across other websites.
- It carries no advertising, and there are no ad networks, no retargeting and no conversion pixels anywhere on it.
- It does not let the analytics account do any of that either. Every advertising feature of it is switched off and the ad click identifiers are stripped from anything the tag sends.
- It does not count anybody who has not said yes, and it does not treat silence as a yes.
Taking control in your browser
Start with the controls on this site, because they are quicker. The panel above turns counting on or off in one press, and each game in the arcade has a button at the foot of it that deletes what that game saved.
After that you are always in charge of what sits on your own device. Every major browser lets you see what a site has saved, delete it, and block more. The wording changes between browsers, but the path is usually the same.
- Open your browser settings and look for a section called Privacy, Security, or Cookies.
- Choose the option to clear browsing data and tick the box for cookies. That wipes cookies for the sites you have visited.
- Look for a setting that blocks cookies. Most browsers let you block cookies from other sites while still allowing the ones a site needs for itself.
- Click the small icon beside the web address to see what one single site has stored, and clear just that one.
- If you get stuck, open the Help menu in your browser and search for the word cookies. Your browser knows its own menus better than we do.
A private window is another simple answer. Anything made in that window is thrown away when you close it.
Clearing this site's data takes your stored answer about counting with it, along with anything the arcade saved. Nothing is lost that matters, and the question will be asked again on your next visit.
One fair warning. If you block every cookie everywhere, some websites stop working properly. On this site, blocking everything would one day mean you could not stay signed in or finish a purchase. Watching a Shar Pei fall off a sofa will keep working perfectly.
Changes to this page
When the site changes, this page changes with it. That is not a promise waiting to be tested. On 9 August 2026 analytics was added to this site, and this page was rewritten the same day to name the cookies it sets, say that none of them is written until you agree, and give you somewhere to change your mind. Everything it used to say about having no analytics is gone rather than softened.
The same happens next time. If accounts or the store open, the sections above get rewritten to describe what is really happening. We are not going to quietly add tracking and hope nobody notices.
Owner suppliedThe date this policy takes effect, and how visitors will be told when it changes. Left blank rather than guessed.
Not legal adviceWhat a consent banner must say, and where one is required at all, depends on where the business is and where its visitors are. Neither has been established here, so this site asks everybody, everywhere, and refuses everything until they answer. That is the strictest of the available approaches rather than a claim to meet any particular rule. This page describes what the site does. It is not a compliance claim and has not been reviewed by a lawyer.
Questions
If anything here is unclear, or you want to know what one particular thing in your browser is doing, please write to info@potatoandhash.com. A real person reads it, usually with a dog asleep on their feet.
Email us about cookies