Cookie policy

This site uses exactly one tracker: Google Analytics 4 (GA4). It sets one cookie. Everything else on the page is static and self-hosted. This page covers what that means, what data is collected, how long it’s kept, and how consent works, roughly in the order people ask.

Cookies, briefly

A cookie is a small file a site stores in your browser. This site only writes cookies through Google Analytics. Google Fonts loads as a stylesheet and sets nothing. There are no ad networks, no social embeds, no comment widgets, and no third-party scripts beyond the analytics tag.

The analytics cookie is a client identifier (usually _ga and _ga_<id>). It lets Google tell you apart from other visitors without knowing your name or email. It’s how the site knows it’s seeing a repeat visitor rather than a new one.

How the tracker is loaded

The analytics tag runs inside a web worker via partytown, so the tracking script never runs on the page’s main thread and can’t slow down rendering. The consent logic runs on the main thread, before the tag loads, which is what lets the site tell Google your consent state before anything is sent.

Consent mode v2

The site uses Google consent mode v2. Four signals start at denied for everyone, set before the tag loads:

• analytics_storage: whether Google may store or read analytics cookies
• ad_storage: whether Google may store or read advertising cookies
• ad_user_data: whether data about you may be sent to Google for advertising purposes
• ad_personalization: whether Google may use your data for ads personalisation or remarketing

The banner is the only thing that changes that. One click on “Got it” updates all four to granted through Google’s consent API. There’s no cookie wall; if you don’t click, the site works exactly the same, the tag just runs with everything denied.

This per-user state is what Google’s admin UI calls not automatically marking data as consented. The GA4 property is configured so Google doesn’t label data as consented on its own; your click is the label. That’s why the property-level toggle stays off and consent comes from the site.

Where consent is stored

Your choice lives in localStorage under the key ga-consent, with the value granted. It isn’t a cookie, and it’s local to this site and this browser. It’s how the site remembers you already answered, so the banner doesn’t reappear on every page.

Because it’s in localStorage, consent is per-browser and per-device. Consenting on your phone doesn’t consent on your laptop.

What Google Analytics collects

GA4 collects, roughly:

• pages you visit and how long you stay
• the referrer, where you came from if anywhere
• your approximate location, derived from your IP. The IP itself is used for geo estimation and isn’t stored in reports
• browser, device type, operating system, screen size
• whether you’re a new or returning visitor

The site collects no personal data from you directly. There are no accounts, no forms that submit anywhere, and no comments. The email address on the site is a mailto: link, so contacting me goes through your own mail client, not through this site.

Nothing here identifies you by name, email, or account. GA4 data isn’t linked to any Google account you’re signed into unless Google’s own cross-product features are involved, and this site doesn’t enable those.

Retention

How long Google keeps analytics data is set inside the GA4 property, not by this site, and this site doesn’t change it. Google’s default is 14 months, with 2 and 26 months as the other options. Individual event data is dropped once it passes the property’s retention window. Aggregated reports drawn from that data can outlive the individual events, which is how GA4 works generally.

The retention window is a two-minute change inside the GA4 admin, which I control. Ask if you want it shorter.

Why consent matters for EEA visitors

Under Google’s EU user consent policy, personal data sent from the European Economic Area for advertising purposes requires consent. If data sent through the tag isn’t labeled with consent, Google won’t use it for things like ads personalisation.

This site doesn’t run ads. The ad-related signals still matter because the tag sends data to Google regardless, and consent mode is how Google is told whether that data may be used for advertising purposes. With the default of denied, Google is told no until you click.

Changing your mind

Consent is per-browser, so revoking it means clearing this site’s stored state in that browser:

• clear localStorage for lukeocodes.dev, or just delete the ga-consent key. The banner comes back and the next page load runs with everything denied again
• or block analytics.google.com in an ad blocker, which stops the tag loading at all
• or disable JavaScript, which means the tag never runs and the banner never appears

There’s no account to delete, because there’s no account.

Changes

This page was last updated August 10, 2026. If anything about how the site tracks visitors changes, this page changes with it.