🍪 Cookie policy

⚡ The short version

Two kinds. The sign-in cookies exist only if you sign in, and the site cannot keep you signed in without them. Measurement is optional, off unless you say otherwise, and refusing it changes nothing about how the catalogue works. There is no advertising, so there are no advertising cookies.

If you never sign in and never agree to anything, this site stores nothing at all in your browser.

🌍 One standard, wherever you are

This site does not work out which country you are in and then decide how much privacy you get. It applies the stricter half of two regimes to everybody:

• From the UK and EU — nothing optional is stored until you have agreed to it. Not after the banner appears, not while you are reading it: before. Refusing is exactly as easy as agreeing, and ignoring the banner counts as refusing.
• From California — if your browser sends Global Privacy Control, that is treated as a binding instruction to opt out of any sale or sharing of your data, and it wins over anything saved on this page. We honour it everywhere, not only where a law names it.

Nothing here is sold, and with no advertising nothing is “shared” for cross-context behavioural advertising either.

🎛️ Your choices

These take effect immediately and last until you change them again. You can come back to this page at any time — it is linked from the footer of every page on the site, under both “Cookies” and “Your privacy choices”.

Your current choices load with the page.

Forgetting your answer puts you back to never having been asked: everything optional stops at once, and you will be asked again. Your browser settings can also block or delete any of this, including the sign-in cookies, at the cost of being signed out.

🔧 Strictly necessary

Set only when you sign in, and there is nothing to decline here: they are what being signed in is. Refusing them would mean refusing to sign in, which you can do by not signing in. All four are first-party, all four are HttpOnly so no script can read them, and all four are SameSite=Lax and Secure.

• __Secure-authjs.session-token — the signed token that says you are signed in and which account it is. Contains an opaque account identifier and nothing else. 30 days, and cleared when you sign out.
• tv_favourites — a leftover, and emptying. Until 4 September 2026 your favourites lived inside this cookie, signed so they could not be edited by hand and capped at 100 shows because that is all a cookie will hold. They are a row on our own server now, and anything still sitting in this cookie is moved across the next time you favourite or unfavourite something. 1 year.
• tv_g_state — a one-time value that protects the sign-in round trip against being forged by another site. 10 minutes, and cleared the moment sign-in completes.
• tv_g_next — remembers which page you were on when you started signing in, so you are returned to it. 10 minutes, and cleared on completion.

Clearing your cookies signs you out. Your favourites survive it: since 4 September 2026 they are a row on our own server rather than the cookie they used to be, so they do follow you to another browser and another device. This paragraph said the exact opposite for longer than it was true, which is corrected here rather than quietly reworded.

💾 Your answer to this page

One more stored value, which is not a cookie and is never sent to any server:

• tvtitles.consent.v2 — local storage, not a cookie. Holds the answer you gave above, as {"measurement":false,"advertising":false}. It stays until you clear it or clear your browser data, and it exists so you are not asked the same question on every page.

It is kept out of cookies deliberately: a cookie is sent to the server on every single request, and a record of what you refused has no business travelling anywhere.

📊 Measurement, and only if you agree

Each page loads Google Analytics 4 once you start using it — the first scroll, tap or key press, or ten seconds after it loads. When you agree, it sets these, both first-party and both readable by scripts on this domain:

• _ga — distinguishes one browser from another, so the counts are of people rather than of page loads. It holds a randomly generated identifier and nothing that names you. 2 years.
• _ga_F9KQH4EV9B — keeps the state of the current visit for this particular property: when it started, and whether it is still the same visit. 2 years.

Neither is set before you agree. Until you answer, and permanently if you decline, Google Analytics runs with every storage permission switched off — it writes nothing and identifies nobody.

The same answer lets this site count page views itself, with one value of its own:

• tvtitles.visitor — local storage, not a cookie. A randomly generated identifier, sent with each page you view so the site’s own counts are of people rather than of page loads. Created only after you agree to measurement, and deleted the moment you withdraw; otherwise it stays until you clear your browser data. The page views sent with it are deleted from our server after 13 months.

Loading it does mean your browser contacts Google on nearly every page, which reveals your IP address, your browser and the page you are on, separately from anything the cookies do. That happens either way, and a content blocker is the only thing that prevents it.

📢 Advertising

None. This site shows no ads and loads no advertising code, so no advertising cookie is ever set. Google Analytics is told not to store or read advertising identifiers. If that changes, this page will list every advertising cookie before any of them can be set, and you will be asked first.

🎞️ Embedded video

Videos are embedded from their original host and load only when you press play, using YouTube’s youtube-nocookie.com domain. A sequence you never play opens no connection to the host and sets nothing.

• YouTube’s own cookies — set on YouTube’s domains once you press play, typically including VISITOR_INFO1_LIVE and YSC, to remember playback preferences and count views. Third-party, and governed by Google’s policy rather than this site’s.

Thumbnails are a separate matter and are not cookies: they load from Google’s image servers on page load, which reveals your IP address to Google whether or not you press anything. The privacy page covers what that means in more detail.

🙅 Nothing else

There is no other tracker, tag, pixel, beacon or fingerprinting script on this site, and no third party is given space to add one. If that ever changes, this page changes in the same release and the date at the top moves with it.