Why this website sets no cookies

Most websites greet you with a box asking for your agreement. You click it away without reading it and finally get to the page. This website has no such box. Not because we hid it neatly, but because nothing happens here that there would be anything to negotiate about.

Since we write elsewhere about how much data protection matters to us, the check belongs here too: what exactly happens when you open this page, what ends up in a database, and what do we never learn as a result? What follows describes it as precisely as the code does — including the one point where a visit does get linked to an email address.

What happens when you open this page

The pages of this website are static files. They are delivered through Cloudflare, an international provider — so this website does not sit in Switzerland, unlike the data our apps will store. Fonts and images come from this website itself. There is no advertising, no social media button and no third-party video embedded, so there is no outside service taking notes on your visit along the way.

Exactly one thing is stored in your browser: a randomly generated string, so that several page views of the same visit belong together. It lives in session storage — not in a cookie — and disappears the moment you close the tab. Open the website again tomorrow and it is a new string, with no connection to today’s.

The difference from a cookie is technically small and practically large:

	Cookie	Session storage
Lifetime	until the expiry date set, often months	until the tab is closed
Reach	every tab, every visit	this one tab only
Transmission	sent automatically with every request	sent only when the page explicitly does so
Recognition	possible across visits	not possible across visits

What we record

For every page view we write one entry into our own statistics. It holds four details plus the identifier of the visit:

• the path of the page — that is, /en/blog/…, without anything that might follow a question mark
• the language of the page — German, English, French or Italian
• the name of the referring website, if you arrived through a link: the hostname only, never the full address, so that a search query or a private URL cannot reach the database in the first place
• the app the page is about, if it belongs to one
• the random identifier of this visit

There is a second event type on top of that: clicks on links leading into one of our apps. That is all. No IP address, no browser type, no screen size, no mouse movement, no device fingerprint. These entries are stored at Supabase in a data centre in Zurich. Views from our own machines do not count; on a development machine the statistics are switched off.

We also use the visitor statistics Cloudflare offers for the site. Cloudflare states that this uses no client-side state such as cookies or localStorage, and that it does not collect visitors’ personal data.

The exception that belongs here

A post about honesty may not leave out the awkward part. If you join a waiting list, we store the identifier of that visit together with your email address — and the first page your visit began on. The pages you opened during that one visit are therefore linked to your entry. That is how we see which posts lead people to an app.

On its own, the identifier is a random string with no connection to a person. From the moment of sign-up it no longer is. That is exactly what our privacy policy says, and deleting the entry dissolves the link too. Without a sign-up it never happens: someone who reads and leaves leaves nothing behind that could be traced to a person.

What these numbers answer — and what they do not

Giving up recognition costs us something, and not a little. The statistics can say which posts are read, in which language, and which websites readers come from. They cannot say how many different people that was.

Question	Can it be answered?
Which posts are read?	yes
In which language is the site read?	yes
Which websites do visits come from?	yes
Which pages belong to one visit?	yes, while the tab stays open
How many different people was that?	no
Does someone come back two weeks later?	no
How does one person develop over months?	no

A hundred views may be a hundred people, or thirty who looked in several times. We do not know, and we cannot find out. That removes everything built on recognition: cohorts, return rates, the path of one person across several visits. Those are real drawbacks — we accepted them, because the alternative would mean recognising your device between two visits.

What remains is enough for the decisions we actually make: which topics are read and which are not, and in which language region. That needs no identifier that survives a month.

How the Swiss rules on cookies are written

The starting point differs from the EU’s, and it sits somewhere you would not look first: not in the data protection act, but in the Telecommunications Act (FMG). Its Article 45c permits the processing of data on third-party equipment by telecommunications transmission only for telecommunications services and their billing — or where users “are informed about the processing and its purpose and advised that they may refuse the processing”. The provision does not speak of cookies at all, but of data on third-party equipment in general, and it has been in force since 1 April 2007.

In October 2025 the Federal Data Protection and Information Commissioner (FDPIC) published guidelines on cookies and similar technologies. They state that Article 45c FMG is a special-law provision to be observed in addition to the general data protection law of the FADP, and that under it website operators inform visitors about the use of such technologies and their purposes, and point out that and how the processing can be refused. The form this takes is left open by the provision.

The FADP comes at it from another side. It requires adequate information about the collection of personal data — at minimum the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients or categories of recipients (Art. 19 FADP). It requires express consent in specific cases, notably for sensitive personal data and for high-risk profiling by a private person (Art. 6 para. 7 FADP). And it requires processing to be designed technically and organisationally so that data protection rules are complied with, with privacy-friendly default settings (Art. 7 FADP). The FDPIC guidelines sort cookie uses along those lines: a right to object in some cases, express consent in others.

What it means day to day

For a visitor to this page it means there is nothing to click away, and nothing left behind when the tab closes. For a bakery in Bern that looks after its own website, it mostly means the question does not start with banners but one step earlier — with which services a page embeds at all. An embedded map, a font service, a video window or an analytics tool each bring their own storage with them. What is not embedded does not have to be explained afterwards. The same thinking applies to a private person running a small club website.

For us it was the simpler route: less code, less to explain, fewer things that can drift apart later. The privacy policy of this website is short because the website does little — not because something was left out while writing it. And if we ever change something here, it will appear there first.