Cookies, sessions, and Turnstile.

• • arcaneleaf_age_gate: set after an adult visitor confirms they are old enough to view the site. It is HttpOnly, same-site Lax, secure in production, scoped to the site, and expires after 180 days.
• • arcaneleaf_internal_session: set after an internal operator signs in. It is HttpOnly, same-site Lax, secure in production, scoped to /internal, and expires after twelve hours.

Turnstile protects public forms from spam and automated abuse. The widget loads from challenges.cloudflare.com, runs a browser challenge, and produces a response token.

When a protected form is submitted, Collared Ribbon sends the response token and the request IP address to Cloudflare's Siteverify API. The app uses the result to decide whether the request can continue. Collared Ribbon does not store the Turnstile response token.

Cloudflare describes Turnstile as processing browser and request signals to distinguish human visitors from bots. More detail is in Cloudflare's Turnstile Privacy Addendum.

This first pass treats the current cookies as necessary security and session cookies. There are no optional analytics, advertising, or marketing cookies to accept or reject in the app today.

Launch traffic checks use hosting logs, manual checks, public QA, and direct tester feedback instead of analytics scripts or tracking pixels. If optional analytics, ads, affiliate tracking, or non-essential personalization are added later, this page and the consent model should be revisited before launch.

You can block or clear cookies in your browser. Clearing the internal session cookie signs an operator out of internal tools.