Legal
Cookie notice
Every cookie this site sets, what it is for, and how long it lasts. The list is short on purpose.
Last updated 29 July 2026
The short version
We use only the cookies needed to make the site work: one to remember your session, one to protect forms against cross-site request forgery, and one more if you tick "remember me" when you sign in. Nothing here tracks you, profiles you or reports back to an advertising network.
Because all of these are strictly necessary to provide a service you have asked for, we do not need your consent to set them and there is no cookie banner. If we ever add analytics or anything non-essential, we will ask you first and this page will change to match.
The cookies we set
| Name | Purpose | How long | Type |
|---|---|---|---|
mindset-reset-hub-session |
Identifies your browsing session so the site can keep you signed in and remember what you are doing from one page to the next. It holds a random identifier, not your details. | 2 hours of inactivity | Strictly necessary |
XSRF-TOKEN |
Carries the security token that proves a form was submitted from this site and not from somewhere else pretending to be you. Without it, forms are rejected. | 2 hours of inactivity | Strictly necessary |
remember_web_… |
Set only if you tick "remember me" when you sign in, so you stay signed in after closing the browser. Signing out deletes it. | Up to 5 years, or until you sign out | Strictly necessary, and optional to you |
The session and remember-me cookies are set as HttpOnly, which means page scripts cannot read them, and as SameSite=Lax so they are not sent along with requests from other sites. On the live site they are also marked Secure, so they only travel over HTTPS.
What we do not use
- No analytics of any kind. No Google Analytics, no page-view counters, no heatmaps.
- No advertising or remarketing pixels, and no social media tracking pixels.
- No third-party chat widgets or embedded trackers.
- No third-party font requests. Our typeface is served from our own server, so loading a page here does not tell anyone else that you visited.
Stripe and the payment pages
When you join or manage your billing, we hand you over to Stripe's own secure pages to enter your card. Stripe sets its own cookies there, on Stripe's domain, for fraud prevention and to make its checkout work. Those cookies are Stripe's and are covered by Stripe's privacy policy and its cookie settings, not by ours.
The members-only Facebook group
The community lives in a Facebook group. That is a link out to Facebook, which is run by Meta and sets its own cookies once you are there. Nothing on this site loads Facebook code, so no Facebook cookie is set unless you follow the link.
Managing cookies
You can block or delete cookies in your browser settings, and every current browser lets you do it per site. Be aware that blocking the two strictly necessary cookies above will stop you signing in and will make every form on the site fail, because the site cannot then tell your submission apart from a forged one.
For more about how we use personal data generally, read our privacy notice.
Questions about any of this
Write to us and we will answer plainly. If your question is about your own data, say so and we will treat it as a formal request.