Cookie Policy
Last updated 2026-09-08
Every cookie this site can set is listed below, with what it does and how long it lasts. Only the strictly necessary ones run before you choose.
What cookies and similar technologies are
A cookie is a small file a site asks your browser to keep, so it can recognise the same browser later. One thing on this page is not strictly a cookie: one entry uses your browser's session storage, which works the same way but is wiped when you close the tab. We list it here because the distinction matters far less to you than what it actually does.
How we ask, and how to change your mind
The first time you visit we ask what you allow. That answer is stored for six months, after which we ask again. We also ask again sooner if we add or change a tracker, so your choice always refers to what is actually running.
You can change or withdraw it whenever you like — this link is in the footer of every page too:
Strictly necessary
Needed for the site to work — remembering your cookie choice and keeping the booking form's spam check functioning. These are never optional and set no advertising identifiers.
One of these is worth calling out: the Cloudflare Turnstile entries are stored under Cloudflare's own domain rather than ours, and only appear once you open the booking form. We cannot read or delete them, which is also why they are not swept when you withdraw consent.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
rune_consent | We Are Rune AB | Stores which cookie categories you allowed, the policy version you were shown, and when you chose. Deleting it makes us ask again. | 6 months |
rune:navDepthSession storage | We Are Rune AB | Counts how many pages you have moved through in this tab, so the “Go back” link on these policy pages knows whether there is somewhere to go back to. | Until you close the tab |
__cf_bm, cf_chl_* | Cloudflare, Inc. | Set by the Turnstile anti-spam widget when you open the booking form, so a check you have already passed is not repeated. Stored under Cloudflare's own domain, not ours. | Session, up to 30 minutes |
__prerender_bypass, __next_preview_data | We Are Rune AB | Set only when a signed-in editor previews unpublished content. Never set for visitors. | Session |
Analytics
Helps us understand which pages people read and where they lose interest, so we can improve the site. Aggregate patterns only — we never try to identify you.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google LLC | Distinguishes one browser from another so repeat visits are not double-counted. | 2 years |
_ga_* | Google LLC | Holds the Google Analytics 4 session state for this property. | 2 years |
— | Vercel Inc. | Web Analytics and Speed Insights measure page views and loading performance without setting a cookie or storing anything in your browser. Listed here for transparency; there is nothing to consent to or delete. | — |
What happens when you withdraw consent
We delete the cookies we can reach and reload the page. The reload is not decoration: a tracking script that has already started running has attached itself to the page and cannot be removed, so loading the page again without it is the only way to genuinely stop it. Cookies set under another company's domain are outside our reach, and are marked as such above — you can clear those through your browser.
Third-party policies
Browser-level controls
Every major browser lets you block or delete cookies from its settings, and most offer a private-browsing mode that discards them when you close the window. Be aware that blocking storage entirely will break the booking form's spam check, and that clearing your cookies removes our record of your choice, so we will ask again on your next visit.
Questions about any of this go to privacy@wearerune.co. For the wider picture, read our Privacy Policy.