Cookie policy
Short answer: this site sets two cookies and both are needed to make it work. There is not a single tracker on it. That is also why this site does not ask you anything: strictly necessary cookies do not require consent, and a window asking for consent where none is needed hollows out the idea of consent.
The cookies that are set
| Cookie | What for | How long |
|---|---|---|
| coderits_session | Holds your session: your language choice, and whether you are logged in to the client portal. Without this cookie you would have to log in again on every page. | 480 minutes after your last visit |
| XSRF-TOKEN | Protects the forms on this site against outside abuse, so nobody can submit anything on your behalf. | For as long as your session lasts |
What is not on it
No Google Analytics, no Google Tag Manager, no Meta pixel, no advertising cookies and no session recordings.
Nothing is stored in your browser that would let you be recognised on a later visit, and no profile of you is built. So whatever is measured here cannot be tied to you as a person and does not follow you to other sites.
That is the rule I hold to: anything that sets a cookie or follows your behaviour across sites does not go on without you being able to refuse it, and without the site working just as well if you do. Should something like that ever arrive, this chapter is rewritten first — not afterwards.
The typeface is on my own server
This used to say that the typeface came from an external service and that your browser made a request to that party for it. That is no longer the case: the typeface now sits on my own server, so nothing at all leaves the site for its styling.
Paying and external pages
When you pay, you go to Stripe's secure payment page. That party places its own cookies to make the payment work and to counter fraud. That happens on their page, not on this site; their policy is at stripe.com/privacy.
If you click a link to WhatsApp or to FlexyNode, that party's policy applies from that moment.
Deleting cookies yourself
You can always delete or block cookies through your browser settings. If you block the two cookies above, you can no longer log in to the portal and the forms will not work; the public pages remain perfectly readable.
Bot check on the forms
The contact form and the account sign-up carry a bot check by Cloudflare Turnstile. It is there because automated messages were coming in through the contact form.
For that, your browser makes a request to that party, and they see your IP address and whether your behaviour looks like a real visitor's. It happens on those two forms only and nowhere else on the site. What that party does with the data itself is set out in their own privacy statement.
Visitor statistics
I measure how many people visit this site, which pages get read, and whether someone arrives through a search engine or through a link. Without that I do not know whether a page is doing its job, and then every change to this site is a guess.
That runs on Cloudflare Web Analytics, and it was chosen deliberately. No cookie is placed in your browser for it, nothing is stored in your browser to recognise you on a later visit, and no profile of you is built. What I see are totals per page and per day, not a trail per visitor.
Cloudflare does process your request data for this, including your IP address, in order to tell visits apart. What Cloudflare itself does with that is set out in their own privacy statement.
This is also why there is still no cookie banner: no cookie is placed that would need consent. If you would rather not be counted, a tracker blocker in your browser stops this script, and the site works exactly the same afterwards.
If something is added later that places a cookie or follows your behaviour across sites, a consent window with a genuine option to refuse becomes mandatory and this page has to be rewritten first.