Most personal sites quietly ship three or four analytics products, each dropping cookies, because every one of them was a one-line install. This one used to be no different — it carried Google Analytics on 36 pages and Heap on 4. Both are gone. What replaced them is a single cookieless counter, and this page exists so you can see exactly what that means rather than take my word for it.
01Cookies
There are none. Not “only essential ones” as a figure of speech — the count is literally zero, on every page, before and after you interact with anything. The counter at the top of this page reads your browser’s actual document.cookie for this origin as the page loads; if it ever shows something other than zero, I have a bug and I’d like to hear about it.
Because nothing is stored on your device for analytics, there is no consent banner blocking your way. Under GDPR and the ePrivacy Directive, consent is required for storing or accessing information on a visitor’s device; cookieless, aggregate counting that stores nothing is the case those rules were carved out for. You still get an explicit opt-out below, because “legally exempt” and “respectful” are different bars.
02The complete storage inventory
Everything this site can put in your browser, why it exists, and how long it lasts. All of it is first-party, none of it is a cookie, and none of it is ever transmitted anywhere.
| Key | Where | Why it exists | Lifetime |
|---|---|---|---|
site-theme | localStorage | Remembers whether you chose light or dark, so the site doesn’t flash the wrong one on your next visit | Until you clear it |
site-privacy-ack | localStorage | Remembers that you dismissed the privacy notice, so it stays dismissed | Until you clear it |
site-analytics-off | localStorage | Written only if you opt out — it is how the opt-out keeps working on later visits | Until you clear it |
ps_user, ps_identity | localStorage, Prompt Studio only | The preference vector that demo personalizes against. It is computed in your browser, from your clicks, and never sent to a server — that is the whole point of the demo | Until you clear it |
| Various widget keys | localStorage, individual posts | Interactive figures remembering their own state (a legend toggled off, an intro dismissed) so they don’t reset as you scroll | Until you clear it |
Clearing site data in your browser removes all of it, and nothing breaks — you just get the defaults back.
03What gets counted, and what it can’t see
Visits are counted by GoatCounter, an open-source analytics service that was built specifically to work without cookies. What it records is deliberately coarse:
| Recorded | Not recorded |
|---|---|
| The page path you landed on | Your IP address (not stored) |
| The referring site, if any | Any cookie or device identifier |
| Browser and screen size, bucketed | Anything that follows you to other sites |
| Country, derived and coarse | Your name, email, or account of any kind |
| A few named events — see below | Mouse movement, keystrokes, session recording |
The named events are a short, deliberately boring list: which posts get read to the halfway point and to the end, which calls-to-action get clicked, and which outbound links get followed. That is enough to know whether writing reaches anyone, and not enough to know anything about you specifically. No profile is built, because there is no identifier to attach one to.
04Your controls
Opt out with the button above. It writes a single local flag and, from that moment, the counter script is never loaded at all — not loaded-then-silenced. Nothing is sent.
Browser-level signals are honoured automatically. If your browser sends Do Not Track or Global Privacy Control, the counter is never loaded and you don’t have to click anything here. Roughly nobody honours these headers, which is exactly why it’s worth doing.
Blockers won’t break anything. If uBlock or your DNS blocks the counter, every page still works completely; the analytics simply never runs.
05Verify it yourself
Privacy claims should be checkable. Open your browser’s developer tools on any page of this site and run:
// should print an empty string, on every page
document.cookie
// the full list of what this origin stores locally
Object.keys(localStorage)Or check from outside the browser entirely — this asks the server for a page and prints any cookie it tries to set, which should be nothing at all:
curl -sI https://sugeerth.github.io/ | grep -i set-cookie06Third parties
Two are contacted when you load a page, and neither can identify you: the analytics counter described above, and Google Fonts for typography. Some interactive posts load charting libraries, and where I could, those are vendored onto this domain so no request leaves it at all. There are no ad networks, no social pixels, no session recorders, no A/B testing services, and no data brokers — and there never will be, because the entire point of a personal site is that nobody is monetizing your attention on it.
Removed in August 2026, and listed here because deletions deserve the same disclosure as additions: Google Analytics 4 (36 pages) and Heap Analytics (4 pages), along with a stray third-party pixel. All three set cookies. None of them were worth what they cost you.
The short version
No cookies. No tracking across sites. No profile. Aggregate counts so I can tell whether anyone read the thing, an opt-out that genuinely stops the script from loading, and a page you can verify in ten seconds.
Questions
If something here is wrong, unclear, or you want your data removed — though I genuinely don’t hold any — email sugeerth@gmail.com and I’ll fix or answer it.