Cookie policy

Last updated: September 23, 2026

Short version

This site sets no advertising and no third-party tracking cookies. We do measure anonymous performance (page timings, Core Web Vitals) — see below — and that measurement uses no cookies either.

What is actually stored

• Cookie notice acknowledgement — a localStorage flag, written only when you dismiss the notice, so we do not show it on every visit. It never leaves your browser.
• Form security token — a PHP session cookie (PHPSESSID), set only when you load the contact page, used to stop spam submissions (CSRF protection). It contains no personal data and expires with your session.
• Console guard — a sessionStorage flag that stops our developer greeting from printing twice in one visit. Gone when you close the tab.

Anonymous performance measurement

We use Cloudflare Web Analytics to measure the critical operations and performance of our web server. It is cookie-less and collects only timing metrics — how fast the page loaded, Core Web Vitals, and aggregate page views. It cannot identify you, does not build a profile, does not follow you to other sites, and query strings are not logged. Measurements are kept unaggregated for 7 days, then reduced to about 10% of their volume for long-term storage.

What this site does not do

No advertising or social pixels, no cross-site tracking, no data brokers, no chat beacons, no fingerprinting. Cloudflare's own documentation states the service "does not collect or use your visitors' personal data" and "does not track individual end users across our customers' Internet properties".

Questions

Write to hello@on.xevels.com.