Legal document
Cookie notice
1. The short version
This site sets no cookies of its own. It runs no analytics, serves no advertising, embeds no tracking pixel, and builds no profile of you. There is no consent banner because there is nothing here that needs consent.
Two things do touch your device or leave a trace, and both are described honestly below: a strictly necessary security cookie that our hosting provider may set, and a request to Google's font servers to fetch two typefaces. Neither is used to track you by us.
The rest of this notice explains the position in enough detail that you can check it yourself with your browser's developer tools, which is the only verification worth having.
2. What a cookie is, and what the law calls it
A cookie is a small text file that a website asks your browser to store and send back on later visits. Related technologies do the same job by other means, including local storage, session storage and pixel tags.
In the United Kingdom this is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003, usually shortened to PECR, read alongside the UK GDPR. Regulation 6 of PECR is the operative rule: storing information on a user's device, or gaining access to information already stored there, requires clear information and the user's consent.
PECR provides a narrow exemption. Consent is not required where the storage or access is strictly necessary for a service the user has explicitly requested. The Information Commissioner's Office reads that exemption narrowly, and it does not stretch to analytics, to advertising, or to anything a site merely finds useful.
3. Why there is no consent banner here
A consent banner exists to collect permission for storage that is not strictly necessary. This site has no such storage, so a banner would be asking you to consent to nothing.
We think a banner in that situation is worse than useless. It trains people to dismiss a control that matters elsewhere, and it implies the site is doing something it is not.
If we ever add analytics, or anything else that falls outside the strictly necessary exemption, we will ask for consent before it loads, we will make refusing as easy as accepting, and we will update this page and its effective date first.
4. What this site actually stores
The site is a set of static files. It has no login, no shopping basket, no form that posts to a server, no session and no user account, so there is nothing for a first-party cookie to remember.
| What | Set by | Purpose | Consent needed |
|---|---|---|---|
__cf_bm or a similarly named Cloudflare cookie |
Cloudflare, our hosting and content delivery provider | Bot management. Distinguishes an automated client from a human one so the site stays available. Set only when Cloudflare's protection engages. | No. Strictly necessary for security and availability of a service you requested. |
| Nothing else | Not applicable | The site defines no cookie, writes nothing to local storage and writes nothing to session storage. | Not applicable |
You can confirm this. Open your browser's developer tools, go to the storage or application panel, and load any page on this site. The cookie list should be empty or contain only a Cloudflare entry, and local storage should be empty.
Cloudflare's own cookie is documented by Cloudflare. Its exact name and lifetime are set by Cloudflare rather than by us, which is why this notice describes it by function rather than pinning a duration we do not control.
5. What this site does not do
- No analytics of any kind. Not Google Analytics, not a privacy-preserving alternative, not a self-hosted one. We do not count visitors.
- No advertising, no advertising network, no retargeting and no conversion pixel.
- No social media buttons, embeds or share widgets, all of which load third-party code and observe you.
- No embedded video, map or comment system.
- No fingerprinting, no session recording, no heatmap, no A/B testing tool.
- No tracking of you across other websites, and no sale or sharing of anything about you.
- No chat widget.
The practical consequence is that we do not know how many people read this page, and we accept that.
6. The one third party this site contacts
The site loads two typefaces from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com when a page loads.
That request does not set a cookie, but it does disclose your IP address and basic request headers to Google LLC, and it is a transfer of personal data outside the United Kingdom. Google states that it does not use these requests to build advertising profiles. We have no way to verify that claim, so we tell you the request happens and let you weigh it.
The content security policy served with every page permits exactly those two hosts and nothing else, which limits what any page on this site can request. You can see the policy in the response headers.
Self-hosting the fonts would remove this request entirely. It is on the list of things to do and is not done yet. Until it is, this notice describes the position as it stands rather than as we would like it to be.
7. Server logs are not cookies
Serving a page produces a log entry at our hosting provider. That is a record kept at the server, not storage placed on your device, so it falls outside PECR. It is still personal data, and it is covered by section 4 of the privacy notice.
A log line records the request: an IP address, a timestamp, the path requested, the response status, the user agent string and the referring page. It is used to keep the site running and to investigate abuse. It is not joined to anything else and it is not used to profile you.
8. Controlling storage in your browser
You do not need our permission to control what is stored on your device. Every current browser lets you view, block and delete cookies and site storage.
- Chrome: Settings, Privacy and security, Third-party cookies, and Site settings for per-site control.
- Safari: Settings, Privacy, Manage Website Data, plus Prevent cross-site tracking.
- Firefox: Settings, Privacy and Security, Cookies and Site Data, plus Enhanced Tracking Protection.
- Edge: Settings, Cookies and site permissions.
Blocking the Cloudflare security cookie may cause Cloudflare to challenge your requests more often, because it can no longer tell that your browser has already passed a check. Nothing else on this site depends on storage, so blocking everything will not break it.
A browser extension that blocks third-party requests will stop the Google Fonts request. The site will then render in your system's default typefaces. The layout is built to survive that and remains readable.
9. Do Not Track and Global Privacy Control
Some browsers send a Do Not Track header, and some send a Global Privacy Control signal. There is no settled standard for how a website must respond to either.
The question does not arise here. This site performs no tracking whether or not a signal is sent, so honouring the signal and ignoring it produce the same result. We mention it so you are not left wondering.
10. If this changes
This notice describes the site as it is on the effective date shown at the top. If we add anything that stores information on your device beyond the strictly necessary, we will update this notice, change the effective date, and put a consent mechanism in place before the new technology loads for the first time.
We will not quietly add analytics and rely on this page having been updated at some point in the past.
11. Questions and complaints
Email hello@vexbe.co.uk with "Cookies" in the subject line. If you believe this notice is inaccurate, tell us what you observed and how, and we will check it and correct the page if you are right.
You may also complain to the Information Commissioner's Office, the United Kingdom supervisory authority for PECR and for data protection. Write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or use the complaint form at ico.org.uk. You can complain to the ICO without contacting us first, although we would rather have the chance to fix it.