( / COOKIES )
We do not set cookies on visitors, and there is nothing to consent to.
Last updated 25 August 2026
Most sites open with a banner asking permission to track you. This one does not, because there is nothing to ask about. That claim is checkable, and we checked it.
What an audit of this site actually found
Every public page was loaded in a clean browser profile and inspected for cookies, browser storage and outbound requests:
| Checked | Result |
|---|---|
| Cookies set for a visitor | None |
localStorage entries | None |
sessionStorage entries | None |
| Third-party hosts contacted | None |
| Advertising or social pixels | None |
Fonts are served from this domain rather than a font CDN, precisely so that loading a page does not hand your IP address to anyone else.
The one cookie that exists
A single cookie, mt_sid, is created when the site operator signs in to the private
admin area. It holds a random session identifier and nothing else — no name, no email, no
behaviour. It is HttpOnly (scripts cannot read it), Secure (it never
travels over plain HTTP) and SameSite=Lax, and it expires after twelve hours.
It is a strictly necessary cookie under the ePrivacy Directive: without it the operator cannot stay logged in. Visitors never receive it.
How we count visits without cookies
We do want to know which pages people read. We do it without identifying anyone.
When a page loads, the server records the path, the referring site, a coarse screen-size band
(xs, sm, md, lg) and the time. To tell one
visitor from another within a single day, it computes a hash of your IP address, your
browser's user-agent string and a secret salt that is thrown away and regenerated every
24 hours.
The consequence of rotating the salt is the important part: once the day is over, the previous day's hashes can never be recomputed. Nobody — including us — can link what you read today to what you read yesterday. The raw IP address and the full user-agent are used to compute the hash and are never written to disk.
This is the same approach used by privacy-first analytics such as Plausible and Fathom. Because nothing is stored on your device and no individual is identifiable, it does not require consent under the ePrivacy Directive, and it is not personal data processing that needs a banner.
What we deliberately do not do
- No advertising, retargeting or conversion pixels.
- No Google Analytics, Meta Pixel, LinkedIn Insight, or any similar tag.
- No cross-site tracking, device fingerprinting or session recording.
- No selling or sharing of anything, to anyone, for any purpose.
- No embedded fonts, scripts or images loaded from someone else's server.
Payment pages
Paying is handled by Stripe, on Stripe's own checkout pages. Stripe sets its own cookies there to run the payment and detect fraud — that happens on Stripe's domain, under Stripe's privacy policy, and we neither control nor receive them. We never see your card number.
If this changes
If we ever add something that does set a cookie or contact a third party, this page changes first and a consent mechanism appears before the thing that needs consent. We would rather have no banner than a banner that is theatre.