Cookie notice

1. Nothing is set until you say yes

Out of the box this website sets no cookies at all. The one thing that would set them — Google Analytics — is not loaded until you press Accept on the banner. Press Decline, or ignore it, and nothing is requested from Google and no analytics cookie exists.

Everything else the site needs comes from this domain: the fonts are served from /fonts/, there is no tag manager, no embedded video and no advertising network. Google Consent Mode v2 is configured to deny advertising storage, advertising user data and ad personalisation permanently — those three are never granted, whatever you choose.

2. What is stored in your browser

These values are held in local storage and never leave your device:

Key	Purpose	Kept
`ceyu.langhint`	Remembers that you dismissed the “this page is also available in…” hint, so it does not reappear on every page	Until you clear browser data
`ceyu.consent`	Remembers your answer to the analytics banner — `granted` or `denied` — so you are not asked again	Until you clear browser data

Both are technically necessary for the function you asked for and are covered by § 25 (2) TDDDG, so they do not require consent. Storing a refusal is what stops the banner from asking on every page. Clearing your browser data removes them; the site keeps working, it just asks again.

Campaign parameters (utm_*, gclid) are held in session storage for the duration of the tab, so that a purchase can be attributed to the link that brought you here. They are discarded when the tab closes and are not a cookie.

3. Reach measurement

Two things measure reach here, and they are not the same kind of thing.

Cloudflare Web Analytics runs at the edge: no cookies, no cross-site identifier, no personal profile, and no consent needed, because there is nothing on your device to consent to.

Google Analytics 4 (measurement ID G-1Q419N2J2M, operated by Google Ireland Limited) runs only with your consent, given through the banner and revocable at any time. Once granted it sets its own cookies — typically _ga and _ga_<container>, both first party, kept up to two years — and records which pages were opened, roughly where in the world from (country and region level), and which site or campaign linked here. IP addresses are shortened before storage. It is used to see which pages are worth writing more of; it is not used for advertising, and the data is not sold or combined with anything else.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG — consent. Transfers to the United States rely on Google LLC's certification under the EU–US Data Privacy Framework. To withdraw consent, clear this site's data in your browser: the banner returns and defaults to nothing being loaded.

4. The Ceyu application

The application is a different matter, because signing in requires it.

Name	Purpose	Properties
`__Host-ceyu_session`	Keeps you signed in and protects against cross-site request forgery	HttpOnly, Secure, SameSite=Strict — not readable by JavaScript

This cookie is strictly necessary for login, session security and tenant-scoped access. It is not used for advertising and it is not shared.

4.2 Local application storage

The web and desktop applications use local storage, IndexedDB and, on desktop, the platform keychain, to hold offline state, preferences and cached workspace data. This is what makes local-first work.

Authentication tokens are deliberately not kept in browser local storage; browser authentication uses the HttpOnly session cookie above, which JavaScript cannot read and therefore cannot leak.

5. Controlling this

Clear site data in your browser to remove everything described here.
Blocking cookies entirely will prevent you from signing in to the application. The marketing site is unaffected.
Local application data can be removed by uninstalling the desktop application and deleting its data directory.

Related: the privacy policy describes what is processed on our side, and Storage, sync & encryption describes where your work is kept.