Cookie notice

Five things happen when you open a page here, and they happen in this order.

1. Your browser asks. It sends a request for a file, carrying its own version string, your network address and, if you followed a link, the page you came from.
2. The file comes back. A static document, a stylesheet, some images and one small script. The response carries no instruction to store an identifier, because there is no identifier for it to store.
3. A second request goes out. The stylesheet asks Google's font service for two typefaces. That is the only outbound call any page here makes, and section 4 covers it fully.
4. Your browser keeps a copy. Files land in the ordinary cache so that the next page loads faster. That cache belongs to you and can be cleared whenever you like.
5. You close the tab. Nothing that identifies you persists on your device, because nothing was written there, and nothing waits to recognise you on a later visit.

"Cookie" is used loosely in most notices, so this one is explicit about scope. A cookie proper is a small labelled value that a server hands to your browser and asks it to return on future visits, which is how a website recognises a returning device.

The same job can be done by several other mechanisms, and a notice that mentions only cookies while quietly using the alternatives is telling half a story. This page therefore treats all of the following as in scope: local storage and session storage, IndexedDB, service workers, tracking pixels and beacons, browser fingerprinting techniques, and identifiers embedded in URLs. Section 3 accounts for every one of them.

The ordinary browser cache is a separate matter. It stores copies of files to save fetching them again, it holds nothing that names or numbers you, and it is under your control rather than ours.

Every storage and identification mechanism a website can use, with the position on this site against each.

The one script

A single script file runs on these pages. It opens and closes the navigation menu on a narrow screen and does nothing else: no measurement, no identifier, no request of its own, no storage. Blocking it costs you the menu button on a phone, and every link remains reachable in the page itself.

Type on this site is set in two families served by Google's font service. Fetching them means your browser contacts Google, and Google therefore learns your network address, your browser and operating system version, and which page triggered the fetch. Google's own privacy terms govern what happens after that, and we have no visibility into it.

Being direct about this is the point of the section. It is the only third party involved in serving these pages, and describing a font dependency as though it were invisible would be exactly the kind of omission this document exists to avoid.

Stopping it

• A content blocker configured to block Google font hosts stops the request outright.
• Privacy-focused browsers frequently block it already, without any configuration from you.
• Reading the site with scripts and remote styles disabled has the same effect.

The consequence of blocking is a page rendered in a substitute typeface. Layout, links, contrast and reading order are unaffected, since nothing here depends on a downloaded font to work.

Serving a page necessarily involves a computer somewhere noting that it did so. The hosting platform records the requesting address, the path asked for, the response code, the size, a timestamp and the browser string, which is the minimum any web server keeps.

Those records belong to the platform, exist for delivery and abuse prevention, and are held on its own short operational cycle. We do not receive them as a feed, do not aggregate them into a picture of any visitor, and do not use them to build a profile. Nothing in that log is joined to anything else, because there is nothing else to join it to.

Visitors accustomed to a consent panel on every European site may wonder where ours is.

The obligation is a European one

Those panels exist because of Article 5(3) of the ePrivacy Directive, which requires consent before information is placed on or read from a user's device, whether or not the information is personal. That rule reaches sites operating in Europe. It is not part of Australian law, and no equivalent provision sits in the Privacy Act 1988 (Cth).

What Australian law asks instead

The Australian Privacy Principles apply to personal information rather than to storage as such. They require that collection be reasonably necessary for a function of the organisation, that people be told what is collected and why, and that a current policy be freely available. This notice, together with the privacy policy, is how those obligations are met.

Why adding one anyway would be worse

A panel here would ask permission for storage that is not occurring, and it would need its own stored value to remember your answer, which means the panel would create the first piece of tracked state on the site. It would also teach one more visitor that clicking through a legal dialogue without reading it is normal. Where consent is genuinely needed, it should be asked for once and honestly; where nothing is happening, silence is more truthful than a dialogue box.

Nothing here should require you to take our word for it. The tools below work on any site, this one included, and are worth knowing regardless of what a notice claims.

• Inspect it. Open your browser's developer tools, look at the storage and network panels, and reload a page. What is listed there is the real answer, and it should match section 3 exactly.
• Refuse storage. Every major browser can block cookies and site data by default or per site.
• Clear it. Clearing site data removes cached files for a domain; on this one that means files, since there is nothing else to remove.
• Block outbound font requests. A content blocker handles the item in section 4.
• Browse privately. A private window discards site data when it closes, which changes little here and a great deal elsewhere.

Every page of this site remains fully readable with scripts disabled, storage blocked and remote fonts refused. That is a deliberate property, and it is the practical test of whether a claim like this one is true.

Some browsers and extensions send a machine-readable preference about tracking with every request. Global Privacy Control is the current one, expressed as a header and a property some sites read. An older header expressing a similar wish is still sent by a few browsers, though it never achieved a settled meaning.

Both are honoured here in the only way that means anything: nothing on this site tracks you, sells information about you or shares it for advertising, so a signal asking us to stop finds nothing to stop. We mention them because a notice that stays silent about preference signals leaves a reader guessing, and guessing is what this page is for avoiding.

An application with accounts cannot behave quite like a set of static pages, so this section sets out what it stores and what it does not.

• A sign-in needs one cookie. A strictly necessary session cookie keeps you logged in between pages, and it does not require consent under any regime, because it is what you asked for by signing in.
• Preferences you set are stored. On your own device, holding the setting and nothing else.
• Measurement is asked for, not assumed. Should product analytics ever become genuinely necessary, it is described here in specifics before it is switched on, with an off switch that works.
• Advertising technology does not appear. No advertising network, no cross-site pixel and no data broker is going to arrive in this product.
• This notice moves first. The page is updated before the behaviour changes, not afterwards.

The version number and effective date in the header of this page move whenever the text does. Any change that introduces storage of any kind is published here first, and is reflected in the privacy policy at the same time.

Questions about anything on this page, including a finding that contradicts section 3, go to hello@amaraai.cc. A report that this notice is inaccurate is a bug report, and it will be treated as one.

Entity: AMARA AI PTY LTD, a proprietary company of New South Wales, ACN 696 682 827, ABN 73 696 682 827.