Legal
Cookies
Twistly sets a small number of cookies. This page names every one of them and says what it does, including the ones we would rather not need.
Last updated
1. Cookies that keep the site working
These are set because the site cannot do its job without them. Signing in is the whole of what they are for; a signed-out visitor browsing roads picks up none of them.
| Name | What it does | How long |
|---|---|---|
| twistly.session-token.v2 | Keeps you signed in. It is the whole of how the site knows who you are. | Expires 30 days after your last visit, or immediately when you sign out. |
| __Host-authjs.csrf-token | Proves a form submission came from this site, so another site cannot make requests as you. | Cleared when you close your browser. |
| __Secure-authjs.callback-url | Remembers the page you were on so signing in returns you to it. | Cleared when you close your browser. |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | Set only during a Sign in with Google round trip, to tie the reply to the request that started it. | Fifteen minutes, and only while a sign-in is in progress. |
All of them are HttpOnly, so no script on the page can read them, SameSite=Lax, so another site cannot make requests as you, and Secure, so they never travel over an unencrypted connection.
2. Analytics, and what it does
Nothing below is set until you say yes. Google Analytics does not load on your first visit. You are asked once, in a note at the corner of the screen, and the script is only fetched if you allow it — declining means it is never requested at all, rather than requested and told to behave. If you have not answered, it is off.
| Name | What it does | How long |
|---|---|---|
| _ga, _ga_* | Set by Google Analytics to recognise a returning browser and group its page views into a visit. | Set by Google, not by us. Google documents the current durations. |
Analytics tells us which pages are read and how people move between them. We do not send it your email address, your account id, your prompts or your routes.
3. How to turn analytics off
Here, whenever you like. Changing your mind has to be as easy as agreeing was, so this is the same choice the note offered, in the same two words:
Failing that, or as well:
Any tracker-blocking extension, or a browser that blocks third-party scripts by default, stops Google Analytics loading here entirely.
Blocking googletagmanager.com has the same effect and nothing else on Twistly depends on it.
Google publishes a browser add-on that opts you out of Analytics across every site that uses it, at tools.google.com/dlpage/gaoptout.
Clearing your cookies removes the ones above. It also clears the answer you gave, so you will be asked again — and until you answer, analytics stays off.
The site works exactly the same either way. Nothing on Twistly is behind analytics.
4. Things that are not cookies but are worth saying
Map tiles. Every map is drawn from tiles your browser fetches directly from MapTiler, which means MapTiler sees your IP address and which part of the country you are looking at. It does not set a cookie on this site.
Photographs. Road photographs load straight from Wikimedia Commons, which sees your IP address for the same reason.
Fonts. The site’s fonts are downloaded at build time and served from our own origin, so loading a page makes no request to Google Fonts.
5. Questions
Ask at hello@twistly.co.uk. The rest of what we store is on the privacy page.