Last updated 8 October 2026

Cookies

There are two, both are sign-in sessions, and neither one is set until you type a code and press a button. Nothing is stored when you arrive on this page or on the home page. That is the whole policy; the rest of this is the detail, published by Roden Muscat, trading as Crowdroll.

What we do not do

No advertising cookies. No analytics cookies. No tag manager, no pixel, no social widget, no third party setting anything on this domain at all. We do not track you across other websites, we do not build a profile of you, and there is nothing here that is shared with an advertiser, because we do not have advertisers.

We do count page views, and it is worth being exact about how. The measurement this site uses is cookieless by design: it records that a page was viewed and which site referred it, and it sets no cookie and no identifier to do so. It was chosen for that reason rather than in spite of it — a consent banner on the first screen of a service whose entire promise is that nobody sees your photographs would cost more trust than the numbers are worth.

The two cookies

Both are set with HttpOnly, which means no JavaScript on this page or any other can read them, SameSite=Lax, which means they are not sent on requests started by another website, and Secure, which means they travel only over HTTPS. Both hold a reference to a session row on our side, so signing out does not merely forget the cookie — it deletes the session, which is why a copy of the value taken beforehand is useless afterwards.

Local storage, which is not a cookie

Two parts of the site keep something in your browser’s own storage rather than in a cookie. The distinction matters for a reason that is in your favour: unlike a cookie, this is never sent to our servers with a request. It stays on your device and the only thing that reads it is the page you are looking at.

The first of those is doing real work for you, so it is worth knowing the consequence of clearing it: if you wipe your site data for this domain in the middle of an event, the browser camera will treat you as a new guest. Your photos are already safely on the roll — nothing is lost — but your name and your remaining shots reset, and you will need the code again.

Why there is no consent banner

Because none is required for what is here, and putting one up anyway would be theatre. European cookie law needs your consent before storing anything that is not necessary to provide the service you asked for. A session cookie that appears at the moment you sign in, and exists only to keep you signed in, is the clearest example of the exemption to that rule.

The commitment that matters is what happens if that ever stops being true. The day anything non-essential is added — an analytics cookie, an advertising pixel, an embedded third party that sets its own — a consent request appears before it is set rather than after, this page changes on the same day, and the date at the top of it changes with it. If you are reading this and the date is old, that is the point: nothing has changed.

Getting rid of them

Signing out of the host console is the clean way: it removes the cookie and kills the session behind it in one step. Beyond that, every browser can clear cookies and site data for a single site, usually from the icon at the left of the address bar, and you can block cookies for this domain entirely. Nothing on the public site breaks if you do. The one thing that stops working is the host console, which cannot keep you signed in without being allowed to remember that you are.

The rest of it

What we collect, how long we keep it and who processes it on our behalf are in the privacy policy, which is the longer document and the one that governs if the two ever disagree. The terms cover the service itself. If you want to ask about any of this, or exercise a right over your data, write to us — a person reads it.

Who publishes this