Cookie Policy

What we don't do

No Google Analytics. No Meta pixel. No advertising or retargeting tags. No social media buttons that phone home. No session cookies, no preference cookies, no localStorage, no fingerprinting. The audit keeps your answers in the page's memory while you're filling it in, and that disappears the moment you close the tab.

We used to load our fonts from Google's servers, which sent your IP address to Google every time you opened a page. That's gone — the fonts are served from this site now, so opening a page here contacts nobody but us.

The one exception

This site sits behind Cloudflare, who protect it from attacks and bots. To do that, Cloudflare sometimes sets a cookie of its own:

• __cf_bm — tells automated traffic from real visitors. Expires after 30 minutes of inactivity.
• cf_clearance — records that your browser passed a security check, so you aren't asked again on every page.

These are strictly necessary security cookies. They carry no advertising identifier, don't follow you to other websites, and aren't used to build a profile of you. Under the ePrivacy Directive, cookies strictly necessary to deliver a service the user asked for are exempt from the consent requirement, which is why they don't trigger a banner. We couldn't switch them off and keep the site protected, and we don't read them ourselves. Cloudflare's own list of what they set and why.

The anti-spam check on our two forms is Cloudflare Turnstile. It was chosen partly because it sets no cookie in its default configuration and sends nothing to an advertising network — unlike the obvious alternative.

Analytics

We use Cloudflare Web Analytics to see roughly how many people visit and which pages get read. It is cookieless: it stores nothing on your device, sets no identifier, and cannot follow you to another website. There is no way for us, or for Cloudflare, to connect a page view back to a person.

That is the whole of it. No Google Analytics, no advertising or conversion tracking, no session recording, no heatmaps.

So there's no banner

A consent banner exists to get your permission before setting cookies that need permission. We don't set any that do. Putting a banner in front of you anyway — to look thorough, or to harvest a click — would be theatre, and it would train you to dismiss the ones that matter.

If we ever add something that genuinely needs consent, you'll get a real choice: it won't load until you agree, refusing will be exactly as easy as accepting, and you'll be able to change your mind afterwards. Our strong preference is to never need one.

Blocking them anyway

Every browser lets you block or delete cookies in its settings. Blocking Cloudflare's security cookies may mean you're asked to pass a check more often, but the site will still work and the audit will still run.

Questions

hello@thepersonalpolicy.com. See also the privacy policy, which covers everything we actually do store.