Legal Data
Cookies
One strictly necessary session cookie in the account area, nothing anywhere else, no analytics — and why there is no consent banner asking you about it.
You have not been shown a banner. Here is why, in enough detail that you can check it.
What this site sets
Two cookies, both set at the same moment, and only when you sign in. Neither is optional and neither is used for anything but keeping you signed in.
dsp_session |
dsp_signed_in |
|
|---|---|---|
| Purpose | The credential your account pages are checked against | Whether the top bar says “Account” or “Sign in” |
| Contains | A session token, and nothing else | The single character 1 |
| Readable by scripts | No — HttpOnly |
Yes, deliberately |
| Other flags | Secure, SameSite=Lax |
Secure, SameSite=Lax |
| Lifetime | Up to 30 days, or the server’s own session expiry if that is shorter | The same, always |
| Third parties | None — set by this origin, read by this origin | None |
The second one needs explaining, because a readable cookie in a list like this usually means
tracking. It does not here. Every marketing and documentation page on this site is a static
file, so the top bar in a cached /pricing has no way to know whether you are signed in.
Six lines of script read that flag and swap one word.
It carries no token, no plan, no email, no expiry and no seat count. It says “a session
cookie exists” — which your browser already knows, since it is the thing holding it. Forge it
and you change a navigation label; the account pages still ask the licence server, which
reads dsp_session and nothing else.
If you never sign in, this site never sets a cookie at all. The homepage, the pricing page, the documentation and this page set nothing.
What this site does not do
- No analytics. No page-view counting, no heatmaps, no session recording, no A/B testing cookie, no visitor id.
- No advertising or tracking pixels, first- or third-party.
- No third-party requests at all from the marketing and documentation pages. Fonts are self-hosted, so not even a font CDN sees your address.
- No
localStorageorsessionStorage. Not for preferences, not for a dismissed banner, not for anything.
Why no banner
Under the ePrivacy rules, consent is needed to store or read something on your device — except where it is strictly necessary to provide the service you asked for. A session cookie that exists only because you signed in is the textbook example of that exception, and a flag that exists only to render the signed-in state of that same session is part of it.
Everything else on this site is exempt for a simpler reason: there is nothing else.
A consent banner in front of a site that sets one strictly necessary cookie would be decoration. Worse, it teaches people that the banner means nothing, which is most of why the things are ignored.
The commitment
If this site ever adds analytics, a tracking pixel, or any cookie that is not strictly necessary, the banner ships in the same commit as the tracker — not in a follow-up, not in the next sprint, not once someone notices. And this page changes on the same day, with the date at the top updated to prove it.
That is a workflow rule as much as a promise: the tracker and the consent mechanism land together or neither lands.
Your browser
You can block or delete cookies from this site at any time. The only consequence is that the account area will not keep you signed in — nothing else on the site depends on one. Signing out clears both, on the same path they were set with, which is the usual place a “log out” button quietly fails.
Questions
Anything on this page can be checked with your browser’s developer tools in about thirty seconds, which is the intended standard of proof. If what you see does not match what is written here, that is a bug and we want to hear about it — see Privacy for where to write.