Cookie Policy.

Last updated: 4 August 2026

This page explains the cookies and similar technologies we use, and how to change your mind. It is written to meet the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.

Nothing optional is set until you agree to it. When you first visit, you are asked. Until you choose, only strictly necessary cookies exist. Rejecting is exactly as easy as accepting — one click, same prominence.

Strictly necessary

These do not need your consent because the service cannot work without them. They are not used for tracking.

• payload-token — keeps you signed in across the shop and the maker tools. Expires after 2 hours.
• mbm-oauth-state — guards the Google sign-in handshake against request forgery. Expires after 10 minutes.
• mbm-consent — remembers your cookie choices, so we stop asking. Expires after 6 months.

We also use browser local storage to hold your work in progress in the maker tools — the images and settings for a figure you have not finished. That never leaves your device unless you ask us to save or generate something.

Analytics — optional

If you agree, we use Google Analytics to understand which pages get used and where people get stuck. We have IP anonymisation on, and we do not use it to identify you personally.

If you do not agree, it is never loaded. No analytics cookie is written, and no request is made to Google.

• _ga and _ga_* — tells returning visits apart, anonymously. Expires after up to 2 years.

Marketing — optional

We do not currently run advertising or marketing cookies. If that changes, we will ask you before setting any, and this page will be updated first.

Changing your mind

You can change or withdraw your choices at any time using the Cookie settings link in the footer of any page. Withdrawing is as easy as consenting, and takes effect immediately.

You can also clear or block cookies in your browser settings. Blocking strictly necessary cookies will stop you being able to sign in.

Third parties

Stripe sets its own cookies on its checkout pages to prevent fraud. That happens on Stripe's own domain, under Stripe's policy, and only when you go through to pay.