Cookie policy
Every cookie this site can put on your machine, in the order they appear — and what each one actually holds
Start with what the server sends
A cookie is a scrap of text that a site stores in your browser and reads again the next time you ask for a page. There are only two ways one can get there: the server attaches it to a header along with the page, or a script inside the page writes it. That distinction is usually buried, and here it is the whole shape of the answer.
Set-Cookie header of any kind. Every cookie described on this page is written in your browser, by a script, and all but one group of them only after you have answered the consent question. You can repeat the check yourself with any tool that shows response headers.So the useful way to list them is not by category and not alphabetically, but by the moment each one can first appear. That is the order below: before you answer, at the moment you answer, only if you said yes, only if the editor signs in, and only if the network in front of the site decides to check your connection. Each table says what the cookie actually holds, because “stores your preferences” tells you nothing and a literal value tells you everything.
1. Before you answer: none
On a first visit, before you have touched the consent banner, no cookie is set and no measurement runs. The measurement tag is loaded with every storage permission set to denied in advance, so it cannot write anything, and if it finds a leftover measurement cookie from an earlier visit where you had not consented, it deletes it.
There is one thing worth being honest about in this section: remembering that you said no also requires storing something. There is no way round that, and the alternative — asking you again on every page for the rest of your life — is worse. So the cookies in the next table appear the moment you answer, whichever way you answer.
2. The moment you answer: the banner’s own cookies
These come from the consent banner running on this site. They hold your answer and nothing else: no identifier that follows you anywhere, no email address, no name, nothing about which pages you read.
| Cookie | What it holds | When it appears | How long it lasts | What clears it |
|---|---|---|---|---|
cmplz_banner-status | One word, dismissed, meaning the banner has been dealt with and should not reappear | The moment you accept or refuse | One year | Changing your answer, or clearing cookies in your browser |
cmplz_saved_categories | A short list of the categories you allowed, for example ["functional","statistics"] | The moment you answer | One year | Changing your answer; withdrawing consent rewrites it |
cmplz_saved_services and cmplz_consented_services | The same answer expressed service by service, rather than category by category | The moment you answer | One year | Changing your answer |
cmplz_policy_id | A number: the version of this policy that was in force when you answered | The moment you answer | One year | A substantive change to this policy, which expires your answer on purpose |
cmplz_statistics and cmplz_marketing | One word each, allow or deny, read by the measurement tag on every page to decide whether it may store anything | The moment you answer | One year | Changing your answer |
cmplz_id | A random string that ties the parts of your answer together in your own browser. It is not sent anywhere and identifies nothing outside this site | The moment you answer | One year | Clearing cookies |
The version number in the fourth row is not bookkeeping. Without it, a quiet edit to this policy would carry an old yes forward into something you had never seen. With it, a substantive change expires your answer and the question is asked again.
3. Only if you said yes to measurement
This is the one decision on this page that is actually yours, and it concerns exactly two cookies. They belong to Google Analytics, run on this site’s behalf to count how many people read which page. If you have not accepted, neither of them exists; if you accept and later change your mind, both are deleted at that moment.
| Cookie | What it holds | When it appears | How long it lasts | What clears it |
|---|---|---|---|---|
_ga | A random visitor number and the time it was created, in the form GA1.1.1234567890.1763000000. No name and no email address are attached to it anywhere | Only after you accept measurement | Two years | Withdrawing consent, which deletes it immediately; or clearing cookies |
_ga_LCEZ7T5TSP | The state of the current visit: when it started, how many pages deep it is. The suffix is the identifier of the measurement property and you can read it in the source of any page here | Only after you accept measurement | Two years | Withdrawing consent, or clearing cookies |
What is measured with them is in the privacy policy: which pages are read, roughly where from, on what kind of device. What is not done is worth stating here too, because people assume the opposite: the measurement is not used to build a profile, is not joined to anything else, is not used for advertising, and this site runs no advertising at all at the time of writing. There are no advertising cookies on this site. If that ever changes, the row appears in this table before the advertisement appears on a page.
4. Only when the editor signs in
These exist because the site runs on WordPress, and a visitor never receives them. They are listed for completeness, since a tool that inspects the site while somebody is signed in will find them and should not find them undocumented.
| Cookie | What it holds | When it appears | How long it lasts | What clears it |
|---|---|---|---|---|
wordpress_test_cookie | The literal text WP+Cookie+check | When the sign-in page is opened: written and read back a moment later, to see whether this browser keeps cookies at all | Until the browser is closed | Closing the browser |
wordpress_logged_in_… | The editor’s user name and a signed token proving the session | Only on signing in to the administration area | The length of the session | Signing out |
wp-settings-… | Screen preferences inside the administration area, such as which panels are folded | Only while signed in | One year | Signing out, or clearing cookies |
5. Only if the network in front of the site checks your connection
This site is not served straight off one machine: it sits behind a network that filters traffic, absorbs attacks and delivers the pages from somewhere nearer to you. When that network decides to verify that a request comes from a person rather than from a script, it can set a cookie of its own. Neither of these appeared in the responses measured on 14 November 2026, and they are listed because they can appear, not because they were observed.
| Cookie | What it holds | When it appears | How long it lasts | What clears it |
|---|---|---|---|---|
__cf_bm | An encrypted token the network uses to tell a browser apart from an automated request. It is meaningless to this site and cannot be read by it | Only if the network runs a check on your connection | Thirty minutes | Expiry; it is renewed if needed |
cf_clearance | A token recording that you already passed such a check, so you are not asked again | Only after you pass a check | Up to one year | Expiry, or clearing cookies |
Those two are strictly necessary for the site to stay available and are not advertising cookies: they are not used to follow you between websites. A site with no filter in front of it disappears under automated traffic within a week, and that is the whole reason this one exists.
Things that are not cookies and still count
Storage in your browser, and fingerprinting a device by its characteristics, raise the same question as a cookie even though neither is one. So, plainly: this site does not fingerprint your device and does not try to recognize you by another route when you refuse measurement — doing that would make refusing meaningless. The page builder behind this site may keep a small amount of browser storage for layout purposes; it carries no identifier and is never read back by anyone.
One thing does leave your browser on every page and is not a cookie: the typeface. The fonts are requested from Google’s font service, which sets no cookie but does see your IP address. Everything else on these pages — the diagrams, the map, the scripts, the images — is served from this site, which is why this document is as short as it is. There are no social sharing buttons, no embedded video, no embedded map from a map company, no comment system and no tag manager.
What refusing costs you, and how to change your mind
Nothing, and one click. Refuse and the site works exactly as it does otherwise: every page, every timetable, every station, the route planner and the map. There is no second prompt on the next page, no degraded version and no wall. The refuse button is as visible as the accept button, which is a legal requirement and also the only arrangement that makes an answer worth anything. What is lost is on this side: we do not learn that you were here.
To change your answer, use the privacy and cookie settings link at the bottom of any page; it reopens the same question. Withdraw consent for measurement and the two measurement cookies are deleted there and then. You can also delete everything from your browser’s own privacy settings at any time — after which this site no longer knows what you answered, and will ask again.
If you think a cookie is here that is not in these tables
Say so, with the name of the cookie and the page you saw it on, at [email protected] or through the contact page. A report like that gets checked, and it ends one of two ways: the row joins the table, or whatever set it leaves the site. Those are the only two acceptable outcomes, and a cookie policy that cannot name what it found is not worth reading.
What happens to the information itself, who else receives it and what rights you have over it — including under California and European law — is in the privacy policy. Who publishes this site is in the legal notice. Supervisory authorities: in the United States the Federal Trade Commission and the California Attorney General; in the European Union, because the publisher is established in Spain, the Spanish data protection agency at aepd.es. You can go to any of them without coming here first. This version of the policy is from November 2026.