Cookie notice

European and United Kingdom law requires consent for cookies that are not strictly necessary to provide the thing you asked for. We do not set any, so there is nothing to consent to, so there is no banner in your way.

That is the entire reason. It is not a design preference and it is not a claim about how much we respect you. It follows from the fact that we sell one document and do not run advertising.

It is first-party, HttpOnly, Secure and SameSite=Lax. It holds no answer, no name and no email address — only the identifier that lets the server find the draft it already holds. It is set the moment you begin an intake and not before. Reading an essay sets nothing at all.

The intake also keeps a copy of your part-finished answers in your browser’s local storage, under the key bch.intake.draft. This is not a cookie: it is never sent to us, it stays on your device, and it exists so that a lost connection does not cost you twenty minutes of typing.

It is deleted when you submit the intake. You can delete it yourself at any time by clearing site data for this domain, and doing so costs you nothing except the unsent draft.

Payment happens on Stripe’s own hosted checkout page, on a Stripe domain. Stripe sets its own cookies there, for fraud prevention and to keep your checkout session alive. Those are strictly necessary to take a payment safely, and they are governed by Stripe’s privacy policy rather than ours.

We do not embed Stripe’s scripts on our own pages, so nothing from Stripe is loaded while you are reading this site.

No analytics cookie. No advertising or retargeting cookie. No social network button that phones home. No tag manager, no heatmap, no session recorder, no A/B testing cookie, no consent-management platform — the last of which is itself usually a tracker.

On the routes that handle health information, third-party scripts, images and connections are blocked by a Content-Security-Policy header rather than merely avoided by policy. The health data notice explains how to read that header yourself.

Do Not Track and Global Privacy Control signals are respected by default, in the sense that there is nothing running for them to switch off.

Every browser can block cookies for a single site, and blocking ours has one consequence: an intake will not survive a refresh, so you would need to finish it in one sitting. Nothing else on the site changes.

If this notice ever stops matching what the site does, that is a mistake and we would like to know. Write to privacy@bencaohouse.com. The version and date at the top of this page move whenever anything below changes.