Cookies & Local Storage
Last updated:
This site sets no cookies. The only thing you could reasonably object to is the page-view counter, so that is what the banner asks about. It stays off until you say yes. Since 18 September 2026 a counted page view carries a visitor number that changes every 24 hours and is erased from the row after 30 days.
1. Cookies
This site sets no cookies of its own, and no third party sets cookies through it. There is no advertising, no tag manager, no social tracking pixel, no Google Analytics, and no embedded video player.
That is about web pages. Mail is different: the messages the application sends about an account carry tracking images put there by the mail provider, and section 3.4 of the Privacy Policy says what they do and how to keep them from loading.
2. What is stored in your browser
Three things may be written to your browser's local storage. None is a cookie, none is sent to a server automatically, and none is used to track you across sites. The visitor number in section 3 is not on this list: it is computed on my server each time a page view is counted, and nothing about it is written to your browser.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
theme |
localStorage |
Remembers whether you chose the light or dark colour scheme. Written only when you use the theme toggle. | Until you clear your browser data. |
theme-at |
localStorage |
Records when you last used the theme toggle, so that choosing a scheme on one of these
two sites carries over to the other rather than each keeping its own. Written at the same
moment as theme, and holds nothing but that timestamp. |
Until you clear your browser data. |
analytics-consent |
localStorage |
Remembers whether you accepted or declined the page-view counter, so you are not asked again. | Until you clear your browser data. |
firebaseLocalStorageDb |
IndexedDB |
Holds your sign-in session token so you stay logged in between pages. Written only if you create an account
and log in, and only under app.tzortzoglou.eu — this site itself loads nothing from
Firebase. |
Until you log out or the token expires. |
app-profile |
localStorage |
Your role in the application (for example User) and nothing else, so the next page can draw
its menu before the server has answered. It decides nothing: the server checks your role again on every
request. Only under app.tzortzoglou.eu, written once you sign in. |
Until you sign out, which removes it. |
weather-geo |
localStorage |
The value 1 if you chose to use your device's location for the forecast, so you are not asked
on every visit. Your coordinates themselves are never stored. Only under app.tzortzoglou.eu. |
Until you turn the choice off, or a location lookup fails, either of which removes it. |
app-rows |
localStorage |
How many rows a few lists had last time (a number per list, such as how many departures were showing),
so their placeholders take the right space and the page does not jump. Only under
app.tzortzoglou.eu. |
Until you sign out, which removes it. |
You can delete any of these at any time by clearing site data in your browser settings. Browser storage is
per-site: theme and theme-at are kept by each of the two sites,
analytics-consent under tzortzoglou.eu, and everything else under
app.tzortzoglou.eu, only once you have an account and sign in. Clearing the theme keys resets that
site to its default appearance; clearing the Firebase entry logs you out; clearing the other application keys
costs nothing but a moment's redraw. None of them is a cookie, so your browser never attaches one to a
request by itself.
3. Your analytics choice
You are asked once, on your first visit. Analytics stays off unless you actively accept — declining
is one click, exactly as easy as accepting, and nothing on the site changes either way. Your answer is remembered in
your browser under analytics-consent and never leaves your device.
What is counted if you accept
This changed on 18 September 2026. A counted page view used to carry no identifier at all. It now carries a visitor number: a 64-bit hash of a secret my server holds, your IP address, your browser's User-Agent string and which of my two sites you were on. A new secret replaces the old one every 24 hours and the old one is destroyed, so two page views from your browser on the same day share a number, and tomorrow's number is a different one with nothing left that could join it to today's.
The counter is mine. Accepting sends one short message to api.tzortzoglou.eu, the same server that receives the contact form; no analytics company is involved and no third-party script is loaded.
What a counted page view stores:
- the number described above
- the path of the page, without its query string or fragment
- which of my two sites it was
- the host of the page that linked you here (
www.linkedin.com, never the full address) - the time
- a coarse browser name, a coarse operating system name, whether you are on a phone, a tablet or a desktop, and which of a handful of width brackets your window falls into
- since 26 September 2026, the country your IP address belongs to, as two letters, looked up on my own server
What reaches my server and is not stored:
- your IP address, an input to the hash, a rate-limiter key and the source of the country, held in memory each time
- your full User-Agent string, the other input taken from your browser
- the full referring URL, which my server reads a host off and then drops, because a full referring address can carry someone's search terms in its query string
- your exact window width, which my server rounds into one of the brackets above and then drops
Nothing in the second list reaches the stored row. There is still no cookie and no fingerprint read off your hardware, fonts or canvas, and a request whose User-Agent identifies it as a bot is not counted at all. The visitor number is erased from the row 30 days after the page view, which leaves the counts and removes the one field that ties one view to another. Until September 2026 this counting was done by GoatCounter instead; nothing goes there now, and what it gathered is frozen. The Privacy Policy sets out the legal basis and what the number does and does not make possible.
This choice covers this site. The signed-in application at app.tzortzoglou.eu counts its own page loads
for everyone, without asking, because that is a service you deliberately logged in to, not an audience being
measured. It stores the same fields, the number included, and still not which account was signed in.
Section 3.2 of the Privacy Policy explains why it is treated differently, and
what the number means inside an audience of a handful of approved accounts.
Why the banner only asks about this one thing
Under Article 5(3) of the ePrivacy Directive (in Sweden, the Electronic Communications Act, lag (2022:482) om elektronisk kommunikation), consent is required before storing or reading information on your device — except where it is strictly necessary for a service you explicitly asked for.
The theme preference and the login token both fall inside that exemption, so asking permission for them would be asking a question with only one honest answer. The page counter is different: it is not necessary for anything, so it is the one thing genuinely worth your consent, and the one thing the banner controls. A banner whose buttons changed nothing would be theatre, and regulators across the EU have repeatedly acted against exactly that pattern.
Because analytics now runs on consent, not on legitimate interest, you can also withdraw it at any time using the button above — as easily as you gave it (Art. 7(3) GDPR).
If this site ever adds anything else that requires consent — advertising, cross-site analytics, an embedded YouTube or Maps frame, a marketing pixel — it will be added to this same mechanism before it goes live.
4. Third parties your browser contacts
Some assets are loaded from other providers instead of this domain. Your browser connects to them directly, so they receive your IP address, user-agent, and the page you were viewing. None of them set cookies here, but the connection itself is a transfer of data, so it is listed in full. The page-view counter is no longer among them: it is a request to my own server, and only if you accepted it. A country code for counted page views is planned and is not in place yet; when it is, the lookup will read a MaxMind database file sitting on that same server, so your browser will still not be contacting anyone new.
| Provider | What it serves | Where |
|---|---|---|
| Google Firebase (Google Ireland Ltd.) | Authentication libraries | Only the sign in, register and private-area pages, or any page if you are signed in on this browser |
| jsDelivr | Confetti animation | Private area |
| Vercel (hosting my own deployment of github-readme-stats) | Rendered GitHub statistics images | Code |
OpenFreeMap (tiles.openfreemap.org) |
Map tiles, fetched a square at a time as you pan. The map software itself is served from my own domain; only the picture comes from here. No account, no key, no cookie. | The Formula 1 and Transit pages inside the signed-in application, and only once a map is actually drawn |
EOX IT Services GmbH (tiles.maps.eox.at) |
Satellite imagery, fetched a square at a time like the tiles above. A cloud-free composite of the European Space Agency's Sentinel-2 data. No account, no key, no cookie. Only if you press the Satellite button — left alone, your browser never contacts them. | The Formula 1 page inside the signed-in application, and only after the Satellite control is turned on |
Where these providers may process data outside the EEA, they do so under their own standard contractual clauses. See the Privacy Policy for the legal bases involved.
5. How to block them
Any content-blocking extension, or a browser in strict tracking-protection mode, will stop these requests. The site is built to stay readable without them: text, layout, navigation, the typeface and every icon are served entirely from this domain, and the GitHub activity graph is built into the page rather than fetched by your browser. On most pages there is nothing left to block. What you lose is the rendered GitHub statistics images on the Code page. Such a blocker may also stop the page-view counter, which is fine: it is the same outcome as declining.
Questions about this page? Email stefanos@tzortzoglou.eu.