Cookies and storage

Take the short version first. Loading a page here writes nothing to your device on our behalf. Nobody counts you, nobody profiles you, nobody plants a marker to recognise you next week, and no product on this site exists to work out who you are.

Two things nonetheless cross the boundary of the page, and both get a clause of their own. A security cookie may arrive from the company that serves the files. Two font files are fetched from Google. Neither is a tracker, both are describable in full, and describing them is cheaper than asking you to trust a summary.

No statute in this country makes you click a button before a cookie may be written. Nothing here mirrors the European ePrivacy Directive, so a banner on a site governed from New South Wales reflects the taste of whoever built it rather than an obligation placed on them.

The Privacy Act 1988 (Cth) is what actually bites. Where storage on a device gathers information about somebody reasonably identifiable, that information is personal information and the Australian Privacy Principles govern it like any other: APP 3 on whether it may be gathered at all, APP 5 on saying so, APP 6 on the uses that follow, APP 11 on protecting it and getting rid of it.

So the useful questions are whether a thing was needed, whether it was disclosed, and whether it stays inside the purpose given for it. Work through the clauses below and you have our answer to each.

A consent dialogue has one job: to gather permission for storage nobody needs in order to serve the page. Since no such storage exists here, a dialogue would be collecting agreement to an empty set.

Putting one up anyway would do damage in two directions. It teaches readers to swat away a control that carries real weight elsewhere. And it hints that something is being gathered, which would make our own notice misleading in the direction nobody bothers to complain about.

Everything capable of landing on your device is listed here. There is no second table.

Both belong to the edge that serves the files. We write nothing, and neither entry gives us a handle by which to recognise you. They exist because anything reachable from the open internet needs some way to distinguish a reader from a script.

No local storage. No session storage. No IndexedDB. No cache entry pressed into service as an identifier. No service worker.

An absence is easier to verify than an assurance, so here is the list to verify.

• No Google Analytics, and equally no Plausible, Fathom, Matomo, Umami or anything else that counts readers.
• No advertising, no advertising cookie, no remarketing tag.
• No Meta pixel, no LinkedIn Insight tag, no TikTok pixel, no conversion measurement of any description.
• No session replay, no heatmap, no scroll-depth capture, no rage-click detector.
• No experimentation or split-testing tool.
• No embedded video, map, social widget, chat bubble or comment thread, each of which usually arrives towing storage of its own.
• No form anywhere, so no form analytics either. Reaching us means typing an address into your own mail client.
• No visitor-identification or company-lookup product, the sort that converts an IP address into a sales lead.
• No fingerprinting, by canvas or by any other route.
• No third-party JavaScript whatsoever. One script runs, it is ours, it comes from this domain, and it opens and closes the menu on a narrow screen.

Lora and Roboto Mono are fetched from fonts.googleapis.com and fonts.gstatic.com. Making that fetch hands Google's servers your IP address, your user agent and the address of the page that sent you. Google's own position is that the Fonts service writes no cookie and that these requests feed neither advertising nor profiling.

It remains a call to a party you never chose. Saying so plainly beats leaving it out on the grounds that everybody does it. Serving both faces from this domain would end the request altogether, and on the day that change ships this clause changes with it.

Block the two hosts, at your network or with an extension, and nothing here breaks. The page falls back to a serif and a monospace face already installed on your machine. No behaviour depends on the download.

Servers write down the requests they answer, and this one is no exception. The provider logs an IP address, a timestamp, the path asked for, the user agent string and the status code sent back.

None of that lands on your device, so it is not storage and consent has nothing to do with it. It is still personal information under the Act, and a page that inventoried device storage while stepping around the logs would be telling a half-truth.

Every serious browser will block storage, delete what has already been written, and show you the current contents. Block the two edge entries from drill 04 and you may meet a challenge more often; the site still works.

• Chrome: Settings, then Privacy and security, then Third-party cookies. Site data shows what is already written.
• Safari: open Settings, choose Privacy, and use Manage Website Data.
• Firefox: open Settings, choose Privacy and Security, and look under Cookies and Site Data.
• Edge: Settings, then Cookies and site permissions.

Send either header and it is honoured. That is a cheap promise here, because there is nothing waiting to be switched off: the behaviour with the header is the behaviour without it.

State the position anyway. A site that quietly disregards these headers has made a choice it would prefer nobody examined, and writing the choice down costs one sentence.

Cookies live in browsers, and the verification service is not something you point a browser at. A rehearsal fires on a schedule against a customer's backup: no operator, no browser, no session, nothing to keep signed in.

Build a customer dashboard one day and it needs at least a session cookie to hold somebody's login, which every classification in the world calls strictly necessary. On the day that exists it joins the table in drill 04, with its name, its lifetime and its job written out, before it ships and not afterwards.

Anything that would write to your device beyond the two entries listed goes into the table before it goes live, under a fresh effective date. Where the law reaching you demands consent, you are asked while the thing is still off rather than once it is running.

Write to [email protected]. Questions about this page come back inside 5 business days. A request under the Privacy Act comes back inside 30 days.

Where our answer leaves you unsatisfied, take it to the Office of the Australian Information Commissioner: GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au. Lodging costs nothing, needs no solicitor, and needs no agreement from us.