What this site stores, and why there is no banner which is almost nothing

Most cookie policies exist to explain away a long list. This one is short because the list is empty: the public pages of this website set no cookies at all. Not analytics, not advertising, not “functional”, not even a consent cookie remembering that you were asked about cookies.

That is checkable rather than asserted. There is no tag manager, no pixel, no third-party analytics package and no embedded third-party script anywhere in this site, so there is nothing that would need one. The one exception is one you choose: pressing “Try it live” on a project on the Work page loads that client’s own website inside the frame, where it runs under its own policies, exactly as if you had visited it.

The site does keep an anonymous count of visits — page, referring site, campaign tag, device type and country, as daily totals — and does it without a cookie, without storing an IP address and without any identifier that could recognise you or connect one visit to the next. A browser sending Do Not Track or Global Privacy Control is not counted at all.

Consent is required before setting anything that is not strictly necessary. Nothing here is set at all, so there is nothing to consent to — and a banner asking you to accept cookies that do not exist would be theatre. Worse than useless, because it teaches people to dismiss the banners that do matter.

If that ever changes — an analytics tool, a video embed, anything that writes to your browser for our benefit rather than yours — a real consent control appears here before it is switched on, not after.

None of these are cookies. Your theme choice is kept in local storage so the site does not flash the wrong colour at you on the next page; a few short-lived values live in session storage, which your browser clears when the tab closes.

Key

pp.theme

Value

Either “light” or “dark”. Nothing else is written.

Written when

You use the theme switch in the header. Never automatically.

Transmitted

Never. It stays on your device and is not sent anywhere.

Removing it

Right-click the theme switch to go back to following your system, or clear site data in your browser.

Session storage

pp.seen (the opening animation has played), pp.landing (the first page of this visit), pp.utm (campaign tags of the link you arrived by), pp.announce.* (you dismissed an announcement) and pp.assistant.v1 (your conversation with the site assistant, if you started one). Cleared when the tab closes. pp.landing and pp.utm leave your device only inside an enquiry you choose to send.

Clients who sign in at /portal to see their invoices and documents get one cookie, pp_portal. It holds a random session token — nothing about you — which the server checks against its own record on every page. It is set only after you enter a one-time code, is unreadable to scripts on the page (httpOnly), is sent only over HTTPS, lasts at most fourteen days and is deleted when you sign out. Like the console cookies below, it is strictly necessary: there is no way to stay signed in without it, and it is never set for anyone who has not signed in.

The console the practice uses to read enquiries and edit content sits behind a sign-in and does use a session cookie, because keeping somebody signed in is not possible without one, and a second cookie, pp_editor, that tells the public pages to show the practice its editing tools. Both are strictly necessary in the meaning of the rule, are set only after a successful two-factor sign-in, and are never set for a visitor to the public site.

If you find anything on this site writing to your browser that is not described above, that is a bug and we would like to hear about it. Write to contact@thepaperplane.co.in.