Cookies & Tracking
This document is complete in substance but still carries placeholders in square brackets for the registered entity, address and governing law. It has not yet been reviewed by a qualified lawyer in the relevant jurisdiction, and it is not legal advice.
In short: We set no cookies, run no analytics, load no third-party scripts and self-host our fonts. There is no consent banner because there is nothing to consent to. The only cookie you might ever see is an infrastructure cookie our CDN can set for bot protection — section 4 explains it and how to check.
1. The claim
accessproof.dev is a static website. It sets no cookies of its own, uses no local storage, session storage, IndexedDB, browser fingerprinting, tracking pixels, web beacons or server-side session identifiers, and it runs no analytics of any kind — not Google Analytics, not a privacy-friendly alternative, not a self-hosted one. We do not know how many people read this page.
That is a real cost. Not measuring means running the business on judgement rather than dashboards. We accept it because a site whose entire argument is "evidence, not opinions" cannot credibly ask you to trust a tracking script.
2. Why there is no consent banner
The ePrivacy Directive requires consent before storing or accessing information on your device, except where it is strictly necessary to provide the service you asked for. We store nothing, so no consent is required, so there is no banner. A banner asking permission for cookies that do not exist would be worse than useless — it would train you to click "accept" without reading.
3. Third-party requests
Loading a page on accessproof.dev makes no request to any third-party domain. Specifically:
- Fonts are self-hosted. Inter and JetBrains Mono are bundled into the site through
@fontsourceand served from accessproof.dev. Your browser never contacts Google Fonts, which would otherwise expose your IP address to a third party on every page view. - No CDN-hosted libraries. No jQuery from a CDN, no icon font, no framework loaded from someone else's server.
- No embeds. No YouTube or Vimeo players, no social share buttons, no comment system, no chat widget, no newsletter popup, no tag manager, no A/B testing script.
- Almost no JavaScript at all. The site is statically generated and ships only the small amount of script its own interactive elements need.
4. The one honest exception
The site is served through Cloudflare. Cloudflare's bot-management and
DDoS-protection layers can set a cookie named __cf_bm, and in
some configurations cf_clearance, to distinguish a browser
from an automated client. We do not enable this for tracking, we cannot
read those cookies for any purpose of our own, and they carry no identifier
we could tie to a person. They are strictly necessary security cookies and
expire in under an hour.
We mention it because "we set no cookies" and "your browser will never receive a cookie on this domain" are different statements, and only the first one is ours to make. Infrastructure you sit behind is still infrastructure.
Cloudflare also processes request metadata — IP address, path, user agent — as described on the sub-processors page. That is server-side logging, not a cookie, and it is what any web server does in order to serve a page.
5. Verify it yourself
Do not take our word for any of the above. It takes fifteen seconds:
- Open developer tools in your browser (⌥⌘I on macOS Safari or Chrome, F12 elsewhere).
- Go to the Network tab and reload this page. Every request should go to
accessproof.dev. If you see a request to any other domain, we have a bug or a broken promise — either way, tell us. - Go to Application → Cookies (Safari: Storage). You should see nothing, or at most the Cloudflare entry from section 4.
- Check Local Storage and Session Storage for
accessproof.dev. Both should be empty.
Found something that contradicts this page? Write to info@accessproof.dev. We will fix the site or fix the page, and say which.
6. The macOS app
The Application contains no web view used for tracking, no advertising SDK,
no attribution SDK, no analytics SDK and no crash reporter that transmits
off-device. Its PrivacyInfo.xcprivacy manifest declares
no tracking domains at all and marks every collected data
type as not used for tracking. Its only required-reason API declaration is
UserDefaults, under reason CA92.1 — storing this
app's own settings on your Mac.
Local settings the app writes to your own machine — window size, your last choices in a form, your Device Token in the Keychain — stay on your machine. They are not cookies and are not transmitted anywhere.
7. Do Not Track and Global Privacy Control
We honour both by construction: there is nothing to opt out of. We do not sell or share personal information, we operate no cross-context behavioural advertising, and a GPC signal reaching this site changes nothing because nothing is being done that it could stop.
8. If this ever changes
If we ever add anything that stores or reads information on your device beyond the strictly necessary, we will update this page before it ships, move the effective date, and — where consent is required — ask for it properly, with a real reject option given the same weight as accept. We will not introduce analytics quietly.
Contact
[LEGAL_ENTITY], [REGISTERED_ADDRESS], [COUNTRY]. Registration [COMPANY_REGISTRATION_NUMBER] · Tax ID [TAX_ID].
One address handles everything — legal notices, privacy and data subject requests, support, security disclosure and accessibility feedback: info@accessproof.dev. Put the subject in the first line and it reaches the right person.