cookies --count 0
Cookies and tracking
Short page, because there is not much to report. Right now this site sets no cookies at all.
Today
No cookies. No analytics. No banner asking you about either.
This site is plain HTML and CSS. It sets no cookies, runs no analytics, and loads no tracking script. The only third party your browser contacts while reading this page is Google Fonts, which serves the typefaces. We are working on removing that too, by hosting the fonts ourselves.
Our web host keeps a standard server log of page requests, which includes IP addresses. That is not a cookie and you cannot turn it off, on this or any other website. We do not use it to identify or profile anyone.
What is coming, and what it will do
Analytics will be added so we can see which pages are read and where visitors came from. When that happens, this page changes on the same day, and so does the privacy policy. Here is what is planned, written down now so you can hold us to it.
- Google Analytics 4 — counting page views and referrers. IP addresses anonymised. No advertising features, no remarketing, no Google Signals. Those would turn this into direct marketing, which is a different thing with different obligations, and we are not doing it.
- Microsoft Clarity, possibly — anonymised recordings of how people move through pages. If we use it, it runs in strict masking mode, which hides the text of everything on screen, and the contact page is excluded from recording entirely. Someone on that page may be in the middle of an incident and describing it, and session recording captures what is typed before it is sent. That is not a risk worth taking for a heatmap.
Why there is no consent banner
Australia has no equivalent of the European cookie rule. The OAIC’s guidance on tracking pixels, published 4 November 2024, sets no blanket requirement to obtain consent before deploying analytics. What it does require is express opt-in consent in three situations: collecting sensitive information, direct marketing, and where consent is the basis you are relying on for a secondary use. We do none of those three.
What the guidance does require is disclosure — in the privacy policy, and as a notice at or before the time of collection. That is what this page is.
So a banner would not make us more compliant. It would add a thing you have to dismiss, and it would quietly cost us a share of our own numbers. We would rather tell you plainly what we measure and let you decide what to do about it.
This position is conditional. If we ever switch on advertising features, remarketing or Google Signals, it stops being true and a consent banner becomes necessary. If you are reading this page and there is no banner, we have not done that.
Turning it off yourself
You do not need our cooperation for any of this.
- Your browser’s privacy settings will block third-party scripts and cookies site-wide.
- Google publishes a browser add-on that opts you out of Google Analytics everywhere, not just here.
- Sending a Do Not Track or Global Privacy Control signal is worth doing, though be aware most sites ignore it. We will honour it if we deploy anything that could read it.
- Or email enquiries@in-sec.org and ask. We will confirm what we have and remove it.
The full picture
Everything we collect, who it goes to and how long we keep it is set out on the privacy page.