Cookie Policy
Last updated: 28 October 2026
This page lists every cookie and every piece of browser storage a visit to devnotes can create, including the ones set by Cloudflare and Google on our behalf. The privacy policy covers the data that reaches our servers; this page covers what stays in your browser.
The short version
- We set no cookies of our own on any public page.
- Traffic analytics is cookie-free and does not follow you between sites.
- Google's ad cookies are only present on long-form posts, and only where consent rules allow them.
- The only first-party cookie on the site belongs to the admin login, which readers never see.
Cookies we set
Reading devnotes creates no cookies from us. There are no accounts, no newsletter, no comment login, and no personalisation, so there is nothing to keep you signed in to.
The single exception is the author's admin session: signing in at
/admin/login sets an httpOnly __Host-admin_session cookie
that lasts seven days and is removed when you sign out. It is never issued to a
normal visit.
Cookies Cloudflare may set
devnotes is served by Cloudflare, which sets these only when it needs to run a security check on a request — for example, if traffic from your network looks automated. A normal page view usually sets neither.
| Cookie | Purpose | Lifetime |
|---|---|---|
__cf_bm | Cloudflare bot management: distinguishes people from automated clients. | About 30 minutes |
cf_clearance | Records that your browser passed a Cloudflare challenge, so it is not asked again. | About 30 minutes |
These are strictly functional: without them Cloudflare cannot tell a script from a reader. They are documented in Cloudflare's cookie reference.
Cookies Google may set
Long-form guides — posts of 400 words or more — load the Google AdSense script. Listings, category and tag archives, search results, the blog, the policy pages and the homepage never load it, so no advertising cookie can come from them.
When an ad is served, Google and its partners may set:
| Cookie | Purpose | Lifetime |
|---|---|---|
__gads | Ad delivery and measurement: which ads your browser has seen, frequency capping, and reporting. | Up to 13 months |
__gpi | Advertising personalisation and measurement across Google's ad products. | Up to 13 months |
__eoi | Stores the advertising consent/measurement state associated with your visit. | Up to 13 months |
Google may also set cookies on its own domains (such as google.com and
doubleclick.net) when an ad loads. Its current list, with purposes and
durations, is in
Google's cookie documentation,
and
how Google uses information from sites that use its services
explains what it does with it.
What we store in your browser
Two small pieces of local storage exist on the public site. Neither is a cookie and neither is sent with requests unless you post something:
-
devnotes-report-toast-dismissed— remembers that you dismissed the "report a mistake" explainer, so it does not reappear. -
devnotes-comment-token:<comment-id>— an edit token issued when you post a comment, so you can edit it later without an account. Only a hash of it is stored on the server.
The admin editor additionally keeps unsent drafts in local storage, which only applies if you are signed in as the author. Clearing site data in your browser removes all of it; the comment itself stays on the site and can be deleted on request.
Analytics
Traffic is measured with Cloudflare Web Analytics, which uses no cookies, no local storage and no fingerprinting, and does not follow anyone to other sites. It reports aggregate page views, referrers, approximate country and device class.
Consent and opting out
No ads are being served while the site is awaiting AdSense approval, so no advertising cookies are set today. Before ads reach visitors in the EEA, the UK or Switzerland, consent will be collected beforehand through Google's certified consent management platform — Google requires that platform for personalised ads in those regions — and the same message lets you change or withdraw the choice later.
You do not have to accept any of this to read the site. Cookies can be blocked or deleted in your browser settings, and the guides work without them. Specific opt-outs:
- Google Ads Settings — turn off personalised advertising.
- aboutads.info — opt out of participating third-party vendors in the US.
- youronlinechoices.eu — the same for the EU.
Changes and contact
If the cookies this site uses change, this page changes with them and the date at the top moves. Questions, or a request to delete something you posted: [email protected].