Privacy

There is nothing to sign up for here, so there is not much to tell. This page is the whole list, including the parts that are true of any website.

What the site stores on your device

One thing of ours: your light or dark theme choice, in localStorage under the key theme. It stays in your browser, it is not a cookie, and it is never sent anywhere. Analytics adds three sessionStorage keys, described below, which die with the tab.

No tracking cookie, no consent banner to dismiss, and nothing stored about what you read or expand. The copy buttons on prompt pages hand text to your clipboard and nowhere else — the whole point of this site is that you take the prompt and leave.

Analytics

Exactly one request leaves your browser for a domain that isn't this one:

https://datafa.st/js/script.cookieless.js

That is DataFast, and that URL is theircookieless build rather than the default one, which sets a cookie. The difference is the reason this page can promise what it promises, so the URL above is printed straight from the site's configuration — swap the script and this page changes with it.

Rather than describe the payload in the abstract, here is every field the script sends, read off the script itself:

• href, referrer, domain — the page you're on and whatever linked you to it.
• language, timezone, screenWidth,screenHeight, viewport — your browser's language, IANA time zone, and window dimensions.
• adClickIds — ad-click parameters if the link you followed carried any (gclid, fbclid, msclkid and five others). This site buys no ads, so in practice it is empty.
• visitorId, sessionId — pseudonymous, and stored only insessionStorage as datafast_visitor_id anddatafast_session_id, alongside datafast_pageview_state.
• cookieless: true — the script telling the server which build it is.

Your IP address and user-agent aren't in that list because every HTTP request carries them regardless. DataFast's documentation says both are inputs to the visitor hash, along with this site's domain and a salt that rotates roughly every 24 hours — so yesterday's identifier cannot be matched to today's. Country-level location is derived from the address at their end rather than asked of your browser. There is no geolocation prompt here and never will be.

We read the script rather than taking a vendor's word for it: the cookieless build contains no reference to document.cookie anywhere, and writes to localStorageexactly never. The default build, which this site does not load, references cookies twice. Fonts and scripts are served from this domain, so no CDN learns you were here by handing you a typeface.

Why there is no cookie banner

Banners exist to ask permission to store or read a tracking identifier on your device. This site stores no such identifier, so there is no permission to ask for. A banner here would be theatre — and the tell for theatre is that clicking either button changes nothing about what actually happens.

Opting out

Before it sends anything, the script checks one flag. Set it from your browser's console on this site and it stays quiet permanently — no account, no request to us, nothing for us to honour or quietly ignore:

localStorage.setItem('datafast_ignore', 'true')

Blocking datafa.st in a content blocker works just as well. Every page here is prerendered HTML: nothing is gated behind analytics loading, and nothing breaks when it doesn't.

Server logs

Cloudflare serves these pages and keeps request logs — IP address, user agent, timestamp, URL — for delivery, caching, and abuse handling. That is inherent to being served by anyone over the internet rather than a choice this site makes on top. We take no per-visitor log out of it and do not want one.

This site is prerendered static pages. There is no login, no session, no user record, and no database of readers to leak.

What we can't tell you

DataFast is someone else's service, and this page won't claim more certainty than we have. Their documentation describes the cookieless identifier as derived from your IP address; it does not publish whether the raw address is discarded after hashing, or which jurisdiction the data is processed in. If the answer matters to you, theirGDPR page is the primary source and you should read it rather than our paraphrase. A directory about running your own software should be the last place to pretend a third party is transparent when it isn't.

What ships next, and what it will store

Outcome reports — worked, partly, failed — are planned on project pages, so that "reported working by readers" can mean something countable. When that form ships, a report row stores the project, the version, your OS, the agent you used, and your note. It stores nothing about your host: no IP address, no domain, no hostname, no credential, and no output from your install. Rate limiting happens at the edge and is not kept with the report. There is no email field, because there is no mailing list.

When that ships, this page changes first. If this page and the code ever disagree, that is a bug worth reporting.

Questions

No accounts means there is no profile to export or delete. There are no ads, no affiliate links, and nothing sold or shared with anyone. For anything else, open an issue — including "your privacy page is wrong about your own stack", which would be a correction like any other.

Last updated 2026-08-05. Changes to this page are commits, and the file history is the changelog.