diff --git a/content/data-and-legal/cookies.md b/content/data-and-legal/cookies.md
new file mode 100644
index 0000000..fad5ce0
--- /dev/null
+++ b/content/data-and-legal/cookies.md
@@ -0,0 +1,66 @@
+---
+title: Cookies
+description: What cookies are set by OpenDLP and why
+---
+
+Cookies are small files saved on your device when you visit a website. OpenDLP uses
+cookies only to make the service work — to keep you signed in, to keep forms secure, and
+to remember your language choice.
+
+**We do not use cookies for advertising, and we never will. We do not use Google Analytics
+or any other tracking or analytics that identifies you or your device.**
+
+Because every cookie we set is essential to providing the service you asked for, we do not
+need to ask for your consent, and there is no cookie banner. This page tells you what we
+store and why, which the law requires us to do.
+
+## Cookies we use
+
+| Name             | Purpose                                                                                                                                          | Expires                                                            |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ |
+| `session`        | Keeps forms secure, keeps you signed in, shows one-off messages (such as "your details were saved"), and remembers the language you chose.       | When you close your browser, or after 7 days, whichever is sooner. |
+| `remember_token` | Set **only if you tick "Keep me signed in"** when you sign in. Keeps you signed in on this device so you do not have to sign in again each time. | After 7 days.                                                      |
+
+Both cookies are set by OpenDLP itself. Neither is shared with anyone else, and neither can
+be read by another website.
+
+## Choosing to stay signed in
+
+The `remember_token` cookie is the one cookie that is not strictly required. We set it only
+when you tick the **"Keep me signed in"** box when signing in. That box is unticked by
+default, so nothing is stored unless you choose it. If you leave it unticked, you stay
+signed in only until you close your browser.
+
+## Your language choice
+
+If you choose a language, we remember it so you do not have to choose again on every page.
+This preference is stored inside the `session` cookie above. You can change it at any time
+by choosing a different language.
+
+## Cookies from other companies
+
+OpenDLP does not set any third-party cookies, and does not embed advertising, social media
+buttons, or analytics services that would set them.
+
+## Managing cookies
+
+You can delete or block cookies through your browser settings. If you block the `session`
+cookie, some parts of OpenDLP — signing in, and submitting forms — will not work, because
+that cookie is what keeps those actions secure.
+
+Guidance for common browsers:
+
+- [Google Chrome](https://support.google.com/chrome/answer/95647)
+- [Mozilla Firefox](https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer)
+- [Apple Safari](https://support.apple.com/en-gb/guide/safari/sfri11471/mac)
+- [Microsoft Edge](https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09)
+
+## Changes to this page
+
+If we change the cookies we use, we will update this page. It was last reviewed on
+**10th July 2026**.
+
+## Questions
+
+If you have any questions about how OpenDLP uses cookies, [contact us at
+opendlp-support@sortitionfoundation.org](mailto:opendlp-support@sortitionfoundation.org).