Cookies

Last updated: 2026-09-16

Every public page on Normdiff — the feed, framework pages, deadlines, and these legal pages — sets no cookies. When you sign in via Telegram, one session cookie is set, but only on the /account/ pages. No analytics. No third parties.

What we do not use

• No cookies on public pages. The feed, framework pages, deadlines, and all legal pages set no cookies. This is machine-enforced by an automated test that checks every public route on every build.
• One session cookie on account pages. If you sign in via Telegram, Django sets a sessionid cookie on the /account/ routes. It identifies your logged-in session, contains no personal data itself, and is deleted when you log out or clear your browser cookies. It is never set until you choose to sign in.
• No analytics. No Google Analytics, no Plausible, no Matomo, no server-side event pipeline. We do not count you.
• No advertising or tracking pixels. Nothing here is monetised by attention.
• No third-party resources. The stylesheet, the fonts, and the one JavaScript library this site uses are all served from this domain. Your browser contacts no other company while rendering these pages, so no other company gets to see your IP address.

The one thing stored on your device

The feed's filters update the page without a full reload, and to make the Back button return you to what you were looking at, the library we use for that (htmx) keeps a copy of pages you have already seen in your browser's sessionStorage, under the key htmx-history-cache.

Concretely, that entry:

• holds a copy of markup your browser had already received — nothing new about you is created;
• contains no identifier, no visitor ID, and no counter;
• is never transmitted anywhere; unlike a cookie, it is not attached to requests, and our server cannot read it;
• is readable only by pages on this domain;
• is deleted by your browser when you close the tab.

Under Article 5(3) of the ePrivacy Directive, storage on your device needs consent unless it is strictly necessary to provide the service you asked for. A same-origin, non-identifying, tab-scoped cache that exists so that the navigation you performed behaves correctly falls inside that exemption. So there is no consent banner — not because we decided banners are annoying, but because there is nothing here to consent to.

You can clear it at any time from your browser's developer tools, or by closing the tab. Blocking it entirely costs you nothing but a page reload when you press Back.

Server logs are not cookies

Connecting to any website reveals your IP address to it, and ours records that in an access log like every other server. That is not storage on your device and it is not something a cookie banner would change. What happens to those logs is set out in the Privacy Policy.

If this ever changes

If we introduce anything that needs consent, this page changes before the code does, and we will ask you first rather than assume. Any new cookie will be listed here with its name, purpose, and lifetime.

We sell attention to compliance, so it would be a poor look to be careless with yours.