Cookie notice

Loading a page from agentixai.fyi leaves no identifier behind in your browser, and gives this company no way of recognising you on a later visit.

Each of the entries below takes one piece of that claim and shows the part of the site responsible for it. The three moving parts of any page here are the markup, one stylesheet and one short script, and none of them is capable of writing a persistent value.

The verification entry near the foot of this page gives the exact sequence of clicks for checking the whole notice in a browser you already have open. Nothing in it requires trusting the paragraph you just read.

This notice is published because browser storage is a privacy question under Australian law, not because a banner regime obliged somebody to produce one.

Australia has no free-standing cookie statute. What governs here is the Privacy Act 1988 (Cth): an identifier stored in a browser is personal information wherever the person behind it is reasonably identifiable, and at that point APP 3 limits what may be collected and APP 5 requires the collection to be disclosed. The question a reader in Australia should be asking is therefore not whether a consent box appeared, but what the site actually stores and who it talks to.

That question is what the rest of this page answers, item by item, in terms specific enough to be falsified. The privacy policy carries the wider position, including retention, overseas destinations and the complaint route to the Commissioner.

No cookie is written under agentixai.fyi, and nothing is placed into local storage, session storage or an indexed database by any page on it.

A cookie has to be written by something: a response header from the server, or a line of script in the page. The server here returns static files, and the single script this site loads contains no storage call of any kind. There is also nothing on the domain that would want one, since there is no account, no basket, no saved preference and no measurement tag to correlate a return visit against.

The whole script is served at /pipette.js and runs to a few dozen lines. Open it and read it: no analytics endpoint, no beacon, no fingerprinting routine, no storage API. It is short enough that reading it is faster than believing this entry.

The only JavaScript on this site opens and closes the navigation menu on a narrow screen. It does nothing else, and the site works without it.

The script attaches one click handler to the menu button and one to the navigation list, and it sets attributes so assistive technology can announce the open or closed state. It fails open by design: until the script runs, the navigation is an ordinary visible list of links, so blocking it costs you a menu animation rather than a page.

Disable JavaScript for this origin and reload. Every link stays reachable, every page renders in full, and nothing sits invisible waiting for a script to reveal it. That last point is deliberate: content hidden by default and shown by script is content that disappears when the script is blocked.

Rendering these pages sends a request to Google's font servers, which means your IP address and browser details reach a company other than this one.

The display face and the monospaced face used throughout the site are hosted at fonts.googleapis.com and fonts.gstatic.com. Your browser fetches a small stylesheet from the first and the font files themselves from the second. Those requests carry what any HTTP request carries: the requesting IP address, the user agent string, and the referring page. Google's published position on that service is that serving a font file involves no cookie at all. This company receives nothing back from those requests, gets no report about them, and holds no record that they happened.

Open the network panel of your developer tools and reload any page here. Two hostnames appear beside this domain, and both belong to that font service. Anything else appearing in that list would contradict this entry, and reporting it would be a service to the next reader.

Block those two hosts in an extension or a hosts file and the pages still render, in the fallback serif and monospaced faces named in the stylesheet. Layout, spacing and every word survive; only the letterforms change. Self-hosting the files would remove the third-party request altogether, and it is on the list of things to change here.

Requesting a page necessarily reveals something to whoever serves it, and this notice would be dishonest if it pretended otherwise.

The hosting provider records ordinary web server log lines: source IP address, timestamp, the path requested, the response code, the user agent and the number of bytes returned. Those lines are what makes it possible to serve pages and to absorb an attack, and no site can be operated without them.

The logs stay with the provider on its own retention cycle. This company exports no copy, keeps no copy, builds no profile out of them and runs no report over them, which is exactly what the inventory in the privacy policy records for that row. A log line is not a cookie: it exists on the server side of the conversation and puts nothing into your browser.

A consent dialogue would have nothing to ask you about, so putting one here would be theatre rather than compliance.

Consent has to attach to a choice. The choice a banner ordinarily offers is whether to permit tracking, and where no tracking is loaded there is no permission to grant or refuse. Worse, the usual implementation writes a cookie to remember your answer, which would mean this site storing an identifier for the sole purpose of recording that it stores no identifiers.

The one genuine third-party request on the site is the typeface fetch, and it is disclosed above with the method for preventing it. Disclosure with a working opt-out is the honest treatment of a request that has to happen before a page can render, and a modal that appears after the fonts have already loaded would not be.

Four checks settle the whole of this notice, and none of them takes longer than a minute.

• Storage. Open developer tools, find the storage or application panel, and look under this origin. Cookies, local storage and session storage should all be empty.
• Network. Reload with the network panel open. Count the hostnames. This domain plus the two font hosts is the entire list.
• Script. Open /pipette.js and read it end to end. It is short, and there is nowhere in it for a tracker to hide.
• Headers. Request any page with a command line HTTP client and read the response headers, including the content security policy, which states which origins a page here is permitted to contact at all.

If one of those four checks disagrees with what this page says, this page is wrong and should be corrected. Write to [email protected] with what you saw. A notice claiming to be verifiable has to mean it in both directions.

Locking this site down in your browser costs you nothing, because there is no feature here that depends on being allowed to store something.

Every current browser can block cookies per site, clear storage for one origin, run a private window that discards everything on close, or refuse third-party requests through an extension. Applied to this domain, each of those leaves the pages working exactly as they do now, with the single visible consequence being the fallback typefaces described earlier.

Try it on the strictest setting your browser offers and reload. Text, layout, tables, navigation and links all behave. A site that degrades under a privacy setting is telling you something about its dependencies, which is why this entry invites the test rather than describing the outcome and hoping.

A Global Privacy Control or Do Not Track header sent to this domain is already satisfied on arrival.

Both headers instruct a site not to sell personal information and not to track across sites. Neither of those activities occurs here, so the request is met by the ordinary behaviour of the site rather than by special handling of the header.

Send the header and compare the response against a request without it. The pages are byte-identical, because nothing in the stack branches on it. Should this site ever gain a capability those signals would bite on, honouring them becomes a mechanism rather than a coincidence, and this entry gets rewritten to say which.

Adding anything that stores or transmits data about a reader means rewriting this page first, with a new version number and date.

The head of this page carries the version in force and the date it took effect. A new third-party request, a measurement script or anything writing to browser storage would each be a material change, and would be described here in the same claim, mechanism and evidence form as everything above, before it shipped.

The commitment is testable in the most direct way available: run the four checks in the verification entry against the live site, and compare what you find against the version of this page in front of you. A mismatch is a failure of this notice, and it can be reported to the address below.