Draft, pending review by a qualified lawyer. The bracketed items are the operator details still to be completed. This page describes what the code actually does, verified on 1 September 2026 — where practice and promise differ, we changed the code, not the words.
DRAFT — NOT VALID FOR PUBLICATION IN THIS STATE. This page was written by reading the source code of this site, not by a lawyer. It is not legal advice. Every bracketed token below —
[OPERATOR LEGAL NAME],[REGISTERED ADDRESS],[CONTACT EMAIL],[EFFECTIVE DATE],[SUPERVISORY AUTHORITY],[HOSTING PROVIDER],[HOSTING COUNTRY]— is unfilled. The site currently has no disclosed legal entity, no registered address and no monitored contact address (lib/site.tsstill ships the placeholdercorrections@berry.example). The country the server physically sits in has not been established, so the "where this is processed" line below cannot be completed or checked. Two positions on this page need a lawyer's sign-off specifically, and are flagged in the text where they appear: whetherberry_navis strictly necessary, and whether a 365-dayberry_railpreference cookie stays inside the user-interface exemption. This page links to/legal/privacy, which does not exist yet. Ship both together or remove the link. A qualified lawyer in the operator's own jurisdiction must review this before it goes live. Where it takes a position on the law, it says so as a position, not as a conclusion.
Last updated: [EFFECTIVE DATE]
This site sets four cookies and stores one preference in your browser. That is the whole list. There is no analytics, no advertising, no tracking, and none of it is set by another company.
This page covers cookies and browser storage only. What we hold about companies, and what we hold about your account, is on the privacy page.
All four are first-party: they are set by almanac.channel and sent back only to almanac.channel. No other site can read them.
| Cookie | What it does | How long | Readable by page scripts? | Set when |
|---|---|---|---|---|
berry_session | Signs you in. The value is a random token. We never store the token itself — only a SHA-256 hash of it — so the table alone cannot be turned back into a working session. | 14 days. It also stops working after 7 days without use. | No — httpOnly | You log in or sign up |
berry_nav | Remembers whether your dashboard is /app, /supplier or /admin, so the header can show "your dashboard" without a database lookup on every page view. It is a hint, not a key: it grants no access, and every protected page still checks the real session. Delete it and you stay signed in. | 14 days | Yes | You log in or sign up |
berry_admin | The operator's own admin console session. Nobody but the operator gets one. | 12 hours | No — httpOnly | An operator logs in at /admin |
berry_rail | Remembers whether you collapsed the dashboard sidebar, so it renders at the right width on the first paint instead of jumping after the page loads. Three states: collapsed, expanded, or not set. | 365 days | Yes | You click the collapse button in the dashboard sidebar. Only signed-in users ever get one. |
All four are SameSite=Lax and scoped to the whole site (path=/).
berry_session, berry_nav and berry_admin are marked Secure when the request arrives over HTTPS. We set the flag from the scheme of the actual request rather than hard-coding it, because a Secure cookie is silently dropped over plain HTTP and would break sign-in without any error. The apex domain redirects to HTTPS; the server also answers on its bare IP address over plain HTTP, and a session started that way gets a cookie without the flag. berry_rail carries no Secure flag in either case; it holds nothing but a sidebar width.
berry_nav and berry_rail are readable by any script running on a page of this site, which today means our own code and nothing else. Every cookie on this list is sent to our server with each request you make to it.
almanac.cookie.notice — set in localStorage when you dismiss the cookie notice at the bottom of the screen. It stores the date you dismissed it, so we do not show the notice again in that browser. It is per-browser and per-device, so dismissing it on one machine does not dismiss it on another, and if your browser blocks storage — private mode, for instance — the notice will come back on the next page, because the dismissal has nowhere to go.
Nothing else in this site uses localStorage, sessionStorage or any other browser storage.
No cookie on this site responds to a "Do Not Track" or Global Privacy Control signal, because no cookie on this site tracks you. That statement is about cookies. It is not a claim that we record nothing — see the next section.
Blocking cookies does not make you invisible to a web server, and we are not going to imply that it does.
None of that depends on a cookie and none of it can be switched off by blocking one. It is described in full, with the tables it lands in, on the privacy page.
This section is our position. It is not a legal conclusion, and a lawyer must confirm it. [verify]
European ePrivacy rules require consent before storing information on your device, but exempt storage that is strictly necessary to deliver a service you explicitly asked for. The rules are Article 5(3) of Directive 2002/58/EC as implemented in each country we operate in, and regulation 6 of the UK's PECR (SI 2003/2426). [verify]
Where we think each one sits:
berry_session and berry_admin — you asked to be signed in; these are what signs you in. We consider these squarely within the strictly-necessary exemption.berry_nav — set as part of signing in, readable only on this site, and it measures nothing. But we should be straight about it: this cookie is a speed optimisation. Sign-in works without it, at the cost of a database lookup and possibly one extra click. That makes it the weaker of our exemption claims, and a reviewer may conclude it needs consent or should be dropped. [verify]berry_rail — a display preference you set yourself with a button click. The user-interface-customisation exemption is at its strongest for storage that lasts a session; ours lasts a year. That duration is the second thing a reviewer should look at, and shortening it may be the simpler fix. [verify]So the notice on this site informs. It does not ask for permission, and clicking "OK" switches nothing on or off — there is nothing to switch. We would rather say that than show a consent box that gates trackers we do not have.
If that ever changes, we ask first. If we add anything that measures, profiles, advertises or reports to a third party, we will ask for your consent before it runs, not after, and this page and the log at the bottom will be updated as part of shipping it — not afterwards. We do not get to add a tracker quietly and fix the small print later.
You can refuse or delete any of these in your browser's settings, and you can block cookies from almanac.channel entirely. Nothing here penalises you for it.
What breaks:
berry_session and you are signed out. You cannot stay signed in without it, so paid features, exports and saved searches stop working.berry_nav and the header may show "sign in" while you are actually still signed in. Everything works; one extra click.berry_rail and the sidebar goes back to its default width.localStorage and the cookie notice comes back.Browsing the public site — the company pages, /live, pricing — works with every cookie blocked.
Signing out clears berry_session and berry_nav for you. It does not clear berry_rail or almanac.cookie.notice; those are yours to delete in your browser.
Being straight about a gap rather than implying a schedule we do not run:
berry_session cookie expires in your browser after 14 days. The matching row in our database is deleted when you sign out, when you sign out everywhere, or the next time that cookie is presented after seven idle days.If you want yours removed now, write to [CONTACT EMAIL] and a person will do it by hand. There is no self-serve button for this yet.
Cookie contents and the records above are processed on our own server, operated by [HOSTING PROVIDER] in [HOSTING COUNTRY]. We share none of it with any analytics, advertising or measurement company, because we use none.
[OPERATOR LEGAL NAME], [REGISTERED ADDRESS]. Questions about this page, or about anything we hold: [CONTACT EMAIL]. We have not appointed a data protection officer; that address reaches a person directly.
If you think we have got this wrong, you can complain to [SUPERVISORY AUTHORITY].
We date this page so you can see what changed and when.
berry_session, berry_nav, berry_admin, berry_rail), one localStorage key (almanac.cookie.notice). No analytics, no third parties, no tracking. The notice informs; it does not ask for consent.