Cookie Policy

We store a small number of things on your device, and all of them exist to make the site work: keeping you signed in, protecting forms against cross-site request forgery, securing a sign-in with GitHub, holding your basket, and remembering a light or dark appearance if you picked one. The full list is in this policy and there is nothing else.

We set no analytics storage, no advertising storage, and no third-party tracking of any kind. This site loads no third-party scripts at all.

You will not see a cookie banner here, and that is deliberate rather than an oversight. A banner exists to collect consent for optional storage. We have none, so there is nothing to ask you about, and a banner that changes nothing would be a pointless click and a misleading one. If we ever add anything optional, we will build a real consent mechanism first and ask you before setting it - not afterwards, and not by assuming.

A cookie is a small file a site stores on your device and sends back to the server with later requests. Local storage is a different mechanism with the same effect: your browser keeps a value for a site and gives it back when you return.

The law treats both the same way, so this policy covers both, and every entry listed below says which of the two it is. It also covers tracking pixels in email, which are described in section 8.

A first-party item is stored by narrativeaddons.com. A third-party item is stored by another company. As set out in section 7, this site currently sets nothing third-party.

These are used to deliver a service you asked for. Without them the site cannot keep you signed in, cannot protect a form from being submitted by a hostile site, cannot complete a sign-in with GitHub, and cannot hold a basket.

Under UK PECR and the EU ePrivacy rules, storage that is strictly necessary for a service the user has requested is exempt from the consent requirement. That exemption is narrow, and we treat it narrowly: nothing is classified as necessary merely because it is useful to us. Nothing in this list profiles you, follows you between sites, or is shared with anyone.

• authjs.session-token (prefixed __Secure- when served over HTTPS) (First party, cookie) - Keeps you signed in between page loads. Without it you would have to authenticate on every request. Set only once you sign in. Stored for: Up to 30 days, and cleared when you sign out.
• authjs.csrf-token (prefixed __Host- when served over HTTPS) (First party, cookie) - Protects sign-in and account forms against cross-site request forgery. Stored for: Session.
• authjs.callback-url (prefixed __Secure- when served over HTTPS) (First party, cookie) - Remembers where to send you back to after signing in, so a sign-in prompt does not lose your place. Stored for: Session.
• authjs.state, authjs.pkce.code_verifier, authjs.nonce (First party, cookie) - Short-lived values that secure a sign-in with GitHub against interception and replay. Written only when you start that flow and discarded as soon as it finishes. Stored for: Up to 15 minutes.
• narrativepro-cart-v1 (First party, local storage) - Holds the contents of your basket before checkout, including for visitors who are not signed in. It stays in your browser and is not sent to us with your requests; the server only learns what is in it when you start a checkout. Stored for: Until you empty the basket, complete a checkout, or clear your browser storage.

One item remembers a preference you expressed.

• narrativepro-theme (First party, local storage) - Remembers whether you chose the light or dark appearance. Nothing is written until you actively pick one, choosing 'system' deletes it again, and it is never sent to the server. Stored for: Until you choose 'system' or clear your browser storage.

We treat this as necessary to a service you explicitly asked for: nothing is written until you actively choose an appearance, choosing "system" deletes it, it is never transmitted to our servers, and it is used for nothing but rendering the page the way you asked. Declining it is not a meaningful choice - the way to decline it is simply not to change the setting.

[COUNSEL] Confirm that treating an explicitly user-selected appearance preference as exempt under PECR reg. 6(4) / ePrivacy Art. 5(3) is acceptable, or whether it must be gated behind consent. If the answer is that it must be gated, the site needs a consent mechanism built before this preference can be stored at all, and section 1 must be rewritten to match.

We measure which listings are viewed and how often files are downloaded, so that sellers get meaningful statistics and we can find what is broken.

We do that entirely on the server. When a listing page is requested we record the view against that listing and roll it up into daily totals in our own database. That requires nothing to be stored on or read from your device, and it therefore sets no analytics cookie and no analytics local storage.

We do not use Google Analytics or any comparable third-party measurement product, and no such script is loaded by this site. If we ever add a measurement tool that stores or reads anything on your device, it will be listed in this policy, it will be off until you turn it on, and declining it will not degrade the site.

There are currently no analytics cookies or analytics storage to list.

None. We do not run third-party advertising on the marketplace, we do not set advertising or retargeting cookies, we do not operate advertising pixels on the site, and we do not sell or share browsing data for advertising purposes.

If that ever changes it will require a new consent from you, not a quiet edit to this page.

On this site: none. narrativeaddons.com loads no third-party scripts, embeds no third-party frames, and hosts no third-party tags, so no other company can store anything on your device while you are browsing here.

Payment. When you check out, we send you to a payment page hosted by Stripe or by PayPal. Those companies set their own cookies on their own domains, on their own pages, to run and secure the payment and to detect fraud, under their own privacy notices. We do not control them and they are not set by narrativeaddons.com.

Sign-in with GitHub. GitHub sets cookies while it authenticates you. That happens on GitHub's pages, under GitHub's policy.

Images on listing pages. A seller may point a listing's images at a host of their choosing, so loading a listing can cause your browser to request an image from that host, which will see your IP address and browser details in the ordinary course of serving it. Those requests are sent with a referrer policy that discloses only our domain and never the page you were looking at, and no such host can store anything on your device through an image. Files you buy are always served from our own storage, never from a third party.

Our email provider, Mailgun, currently records when a message we send is opened. It does that by including a small invisible image in the HTML version of the message, which loads from Mailgun when your email client displays it. This is on for every message we send, including transactional mail such as receipts, licence keys and download links.

We are not comfortable with that being on for transactional mail and it is on our list to turn off; this policy will be updated when it is. We are telling you now rather than describing a state we have not reached yet.

Link click tracking is off by default and is not enabled on account or security email, so links in verification and password-reset messages are our own and are not rewritten through a third party.

You can stop open tracking immediately by disabling remote image loading in your email client, which every major client supports, or by reading the plain-text version. You can also ask us at [email protected] to disable it for your address.

We do not currently operate a marketing mailing list. If we start one it will be opt-in, separate from account email, and every message will carry an unsubscribe link that works.

Because we set nothing optional, there is no consent to give and none to withdraw, and so there is no consent banner and no cookie settings panel. If you have seen a claim to the contrary in an older version of this page, it was wrong and this version corrects it.

You are still in control of everything listed here. Every major browser lets you view what a site has stored, delete it, block it, and block third-party storage specifically; the instructions are published by each browser vendor. Deleting our items is safe: you will simply be signed out and your basket will be empty, because those are the jobs they do.

Do Not Track and Global Privacy Control: we set nothing optional in any case, so these signals do not currently change anything. Should we ever introduce an optional category, a Global Privacy Control signal will be honoured as a refusal of it, without you having to do anything else.

If we ever add optional storage, we will ask first, accepting and refusing will be equally easy and equally prominent, refusing will not degrade the site, and withdrawing will be as easy as giving. Until that mechanism exists, nothing optional ships.

The durations are given for each item in the lists above. In summary: the sign-in cookies last for your session or up to 30 days if you stay signed in; the sign-in security values last minutes; the basket and the appearance preference live in your browser until you clear them, empty the basket, or change the setting back.

All of it is stored per browser and per device. If you use another browser, another device, or a private window, none of it follows you there.

We update this policy when what we store changes, and the lists above are the authoritative inventory. The effective date is at the top of this page. This document is checked against the running application, and a change to authentication, checkout, email or analytics is a change that requires re-checking it.

Questions about what we store, or about the personal data it relates to: [email protected]. See also our Privacy Policy and our GDPR notice.