Cookies

Last updated: 2026-09-29

Every public page on Normdiff — the feed, framework pages, deadlines, and these legal pages — sets no cookies. When you sign in, with Google, Microsoft, GitHub or Telegram, a session cookie and a form-protection cookie are set, but only by the sign-in (/auth/) and /account/ pages. No analytics. No third parties.

What we do not use

• No cookies on public pages. The feed, framework pages, deadlines, and all legal pages set no cookies. This is machine-enforced by an automated test that checks every public route on every build.
• Two cookies on sign-in and account pages. When you open the sign-in page, Django sets two cookies from the /auth/ and /account/ routes. sessionid identifies your session once you are signed in; it lasts two weeks and is deleted when you log out. csrftoken stops another site from submitting our sign-in and account forms in your name; it holds a random value, is replaced each time you sign in, and expires after a year unless you clear it. Neither contains personal data, neither is set until you open the sign-in page, and like any cookie your browser sends them back with requests to this site until they expire or you clear them. Both are strictly necessary for the sign-in you asked for, which is why they need no consent banner (ePrivacy Directive, Article 5(3)). Signing in with Google, Microsoft or GitHub takes you to their site, which sets its own cookies under its own policy; we never load their scripts on our pages.
• No analytics. No Google Analytics, no Plausible, no Matomo, no server-side event pipeline. We do not count you.
• No advertising or tracking pixels. Nothing here is monetised by attention.
• No third-party resources. The stylesheet, the fonts, and the one JavaScript library this site uses are all served from this domain. Your browser contacts no other company while rendering these pages, so no other company gets to see your IP address.

What the public pages store on your device

The feed's filters update the page without a full reload, and to make the Back button return you to what you were looking at, the library we use for that (htmx) keeps a copy of pages you have already seen in your browser's sessionStorage, under the key htmx-history-cache.

Concretely, that entry:

• holds a copy of markup your browser had already received — nothing new about you is created;
• contains no identifier, no visitor ID, and no counter;
• is never transmitted anywhere; unlike a cookie, it is not attached to requests, and our server cannot read it;
• is readable only by pages on this domain;
• is deleted by your browser when you close the tab.

Under Article 5(3) of the ePrivacy Directive, storage on your device needs consent unless it is strictly necessary to provide the service you asked for. A same-origin, non-identifying, tab-scoped cache that exists so that the navigation you performed behaves correctly falls inside that exemption. So there is no consent banner — not because we decided banners are annoying, but because there is nothing here to consent to.

You can clear it at any time from your browser's developer tools, or by closing the tab. Blocking it entirely costs you nothing but a page reload when you press Back.

Server logs are not cookies

Connecting to any website reveals your IP address to it, and ours records that in an access log like every other server. That is not storage on your device and it is not something a cookie banner would change. What happens to those logs is set out in the Privacy Policy.

If this ever changes

If we introduce anything that needs consent, this page changes before the code does, and we will ask you first rather than assume. Any new cookie will be listed here with its name, purpose, and lifetime.

We sell attention to compliance, so it would be a poor look to be careless with yours.