Cookies

No cookies are set by this site. There is no session cookie, no preference cookie, no analytics cookie and no advertising cookie.

No analytics runs. There is no Google Analytics, no tag manager, no product analytics, no heatmap, no session recorder and no advertising pixel. I do not know how many people read a given page, and that is the trade I have made.

Fonts are self-hosted. The typefaces are downloaded, subset and served from this site's own origin at build time. Nothing reaches a font CDN. This is deliberate: loading a font from a third-party CDN sends the reader's IP address to that CDN on every page view, and German courts have held that doing it without consent is an unlawful transfer. Self-hosting removes the problem rather than papering over it with a banner.

Video embeds do not load until you press play. What you see before that is a still image served from this site. Pressing play swaps in an embed on youtube-nocookie.com, and only then does anything reach YouTube. The click is the consent, which is why the poster frame exists at all.

The newsletter form stores nothing on your device. What you type stays in the page's memory until you submit or leave.

Two internal pages use session storage. The design comparison pages, used for choosing between visual treatments and not part of the public site, remember your last selection in your browser's session storage so the page does not reset as you look. It never leaves your device and your browser discards it when you close the tab.

The rule that produces cookie banners (Art. 5(3) of the ePrivacy Directive, and PECR in the UK) is about storing information on your device or reading information already there. It is not only about cookies; local storage, session storage and device fingerprinting are all caught by it.

This site does neither on any public page. There is nothing to consent to, so a banner would be a consent request for something that is not happening: friction that teaches people to click "accept" without reading, which is the opposite of what the rule is for.

The video embed is the one place where a third party could set storage, and it is handled by not loading it until you deliberately ask for it.

This page is true today and it is not a permanent state. Any one of the following makes a consent mechanism necessary, and each of them is a realistic thing to want:

Analytics of any kind, including the privacy-friendly ones: several are cookieless, but "cookieless" and "stores nothing on the device" are not the same claim and each needs checking on its own terms. An advertising or conversion pixel. A chat widget, CRM tracker or scheduling embed that loads automatically rather than on a click. Any third-party font, script or media that loads without the reader asking for it. A logged-in area, which needs a session cookie; that one is strictly necessary and does not need consent, but it does need to be disclosed here.

If any of those is added, this page and the privacy policy get updated in the same change as the feature, not afterwards. Shipping the tracker first and the disclosure later is how sites end up with a policy that describes a site that no longer exists.

There is nothing here for you to switch off, which is the point. Your browser's privacy settings will block cookies and storage from any site including this one, and clearing site data clears the session storage described above.

If you press play on a video, whatever Google sets at that point is governed by Google's own policies and controlled through your Google account and browser settings, not here.

Write to [PLACEHOLDER: public contact email]. Put the word in the subject line if you like; it does not need to be formal, and it does not need to come from a solicitor.

The date at the top is the date this was last checked against the code rather than against memory. If you find something on this site that contradicts this page, that is a bug and I want to hear about it.