Cookie notice

Nothing on this site tracks you, measures you, or is set to find out anything about your visit. No analytics, no advertising, no preference profiling. There is no cookie banner, and the reason is worth being exact about: a banner collects consent, and nothing described here runs on consent. There would be nothing for you to refuse.

What that does not mean is "nothing is stored". Four things can end up in your browser, and this page names all four, because a notice that says "nothing" while storing something is worth less than no notice at all — and that is not a hypothetical, it is what this page did until 2026-09-01.

Two of them are storage keys and are never sent to a server. They apply to anyone reading the site.

Two of them are cookies, which do travel to the server with each request. Both exist only for signing in, and if you have never been given a login you will never receive either.

The home page opens with a short animation. So that it does not play every time you move between pages, the site writes a single value to your browser's session storage — the key yoros-entry, holding the number 1.

That is the whole of it. It records that the animation has played, and nothing else: not who you are, not where you came from, not what you looked at. It is not a cookie, so it is never sent to a server with a request — it stays in the browser tab. Session storage is cleared when you close the tab, so a visit tomorrow starts over.

If you block it — some private-browsing modes do — the page still works. The animation simply plays again.

This one exists only if you start the diagnostic, and it is the reason this page was rewritten. The intake is a long form, and losing your answers to a closed tab or a stray click would be a poor way to treat somebody who has just spent twenty minutes describing their business. So as you answer, the site keeps a draft in your browser's local storage — the key yoros-intake-v1.

It holds what you have typed into the form and how far through it you are. Nothing else, and nowhere else: it never leaves your browser. There is no request that carries it, no server that receives it, and no copy of it anywhere I can read. It exists so that you can come back and carry on.

Local storage is not cleared when the tab closes — that is the point of it, and it is the one real difference between this key and the one above. It stays until something removes it. Three things do: finishing the intake, which clears it; starting over, which replaces it; and clearing site data in your browser, which removes both keys and anything else this site has left with you.

If you never open the diagnostic, this key is never written.

This one is a cookie, which means it is sent to the server with each request — that is the difference between it and the two keys above, and it is the reason it gets its own section rather than a footnote.

It exists so that signing in lasts. Without it you would be signed out on every page you opened, which is not a privacy feature, it is a broken login. It holds the Supabase authentication session — a token proving that the sign-in happened — and nothing describing you or what you looked at.

You only have it if you have a login. There is no public sign-up and no account to create on this site; the only logins that exist are mine and, where an engagement calls for it, a client's, issued by me. If nobody has given you one, this cookie has never been set in your browser.

It is a strictly necessary cookie and it is not offered as a choice, because the only thing refusing it could do is stop you signing in. Signing out clears it, and so does clearing site data.

The other cookie, and the smaller of the two. Its name is yoros-view.

While the site is held behind a holding page, I need to be able to look at the public pages as a visitor would see them. Setting this cookie from the admin surface is how. It holds one fixed value and records a display preference of mine — nothing about you, and nothing about anyone who is not signed in as an administrator.

It can only ever show less of the site than you would otherwise see, never more, and it is set from behind a login you would have to hold first. If you are reading this without one, it has never been set in your browser.

Beyond those four, nothing about your visit is recorded, measured, or sent anywhere. There is no Google Analytics, no Plausible, no Meta pixel, no LinkedIn tag, no heatmap and no session recorder.

I do not know how many people read this page, which pages they came from, or what they did next. That is the trade, and I have made it on purpose: a site arguing for restraint in how systems are built should not be instrumented like a funnel.

The site is served by Vercel, which — like every web host — sees the request that fetches each page, including your IP address. It uses that to deliver the page and to defend against abuse.

That is server infrastructure rather than a cookie, and it happens on every website you have ever visited. It is covered in the privacy notice.

Fonts are self-hosted, so loading a page makes no request to Google Fonts or any other provider. There is no embedded video, no third-party chat widget and no social embed.

Every byte this site serves comes from this site.

It will, eventually. Booking is planned for a later phase, and a booking flow needs at least a session.

This page used to promise it would be updated before the feature ships rather than after. That promise was made and then broken: the intake was built, it started keeping a draft in local storage, and this page went on describing one key for several days. Saying so is more use to you than repeating the promise, because it tells you what this notice is worth — it is reconciled against the code rather than written from memory, and the site now fails its own build if a key is written that this page does not name.

Anything that is genuinely optional will be optional.