Legal

Cookie policy

AntiNCII is a confidential case-intake service for adults facing non-consensual intimate image abuse. This page lists the cookies and similar storage this site actually uses. Last updated 27 August 2026.

What this policy does not cover with cookies

We do not use advertising cookies, social-media pixels, marketing tags, or analytics products (such as Google Analytics). We do not drop a cookie to follow you around the web, to recognize you on a later visit as a survivor, or to store a photo, video, fingerprint, case number, or password.

Cookies we set

antincii_csrf

A first-party, strictly necessary cookie. It holds a random token so that form posts (create a case, check status, withdraw a case, partnership inquiry) come from a page you just loaded on this site. It is HttpOnly, SameSite=Lax, Secure on HTTPS, path /, and expires after about two hours. Without it, those forms cannot be submitted safely. Browsing the rest of the site does not require this cookie; it is set when a form page calls /api/csrf.

Similar storage on your device

These are not HTTP cookies. They stay in the browser and are not used to track you across sites.

• sessionStorage key antincii_quiz — eligibility answers while you move from the wizard into Create a case. Cleared when you close the tab. Never sent as a cookie.
• sessionStorage key antincii_admin — only on the internal reviewer desk, for the admin secret. Not used on public pages.

Third parties that may set cookies

Google reCAPTCHA

On Create a case, Check status, and the partnership form, the browser loads Google reCAPTCHA v3 so automated abuse of those forms is harder. Google may set its own cookies (often _GRECAPTCHA) and process a token, device signals, and your IP under Google’s privacy policy and terms. We receive only a score/token to accept or refuse the submit. reCAPTCHA is not loaded on informational pages such as How it works or Resources.

Cloudflare

This site runs on Cloudflare. Cloudflare may set strictly necessary cookies for security, bot management, or routing (for example __cf_bm). We do not use those cookies to profile people who open a case. See Cloudflare’s privacy policy.

Fonts

Pages load typefaces from Google Fonts. That is a network request to Google, not a cookie we set. Google may see the request, including your IP address.

Why there is no cookie banner

EU and UK rules generally allow strictly necessary cookies without a prior opt-in. The CSRF cookie and Cloudflare security cookies fall in that class. We do not run advertising or analytics cookies that would need a consent wall. reCAPTCHA is loaded only on the forms that need abuse protection. If you do not want Google’s script, do not submit those forms; you can still read the site and use other help listed on Resources.

How to control cookies

You can delete or block cookies in your browser settings. Blocking antincii_csrf will stop case, status, and partnership forms from working. Blocking Google cookies may stop reCAPTCHA and therefore those same forms. That does not delete a case already stored on our side; cases are identified by the case number and password you chose, not by a cookie.

Related notices

What we store in the case database is described in the privacy notice, not in cookies. Terms of use: Terms. Questions: ceo@antincii.org. Do not email intimate photos or videos.