Privacy at The Short List
Nothing that follows you around. What this site keeps, what the server notes and what happens when you click through to Candy.
Background collection
Nothing runs in the background: there are no analytics or advertising scripts, no tracking pixels and no embeds; fonts, images and scripts are all served from this domain.
On your device
Confirming the age notice stores tsl_age with the value yes, both in the browser's local storage and in a cookie of ours that lasts a year, so the notice stays away on later pages. It names nobody and is read by this site alone. Clearing the site's data removes it.
On our server
The rented server we use does not record ordinary page views. A failed request can leave an error entry with an IP address and the page asked for, read only to fix faults.
Notes you send
The contact form delivers what you type, an optional name, your email, the topic and the note, to a server we run ourselves; the editors read notes there, and each one is erased within 30 days. Your address serves the reply and nothing else. To hold off spam, your IP address is converted on the server into a keyed one-way code, used only to limit notes per connection per hour and wiped within two hours; the address itself is not kept.
Links to Candy
Our Candy links add via and fp_sid so Candy knows the visit came from us; they carry nothing about you. Once candy.ai opens, its privacy policy and cookies apply.
Adults only
The site is for adults. Nothing from anyone under 18 is knowingly collected, and a note that turned out to come from a minor would be deleted.
Last updated October 26, 2026.