Cookie notice

This website sets no cookies. It runs no analytics. It stores nothing in your browser. There is no consent banner because there is nothing to consent to, and a banner asking permission for nothing would be theatre.

Two things still reach beyond the page, and both are named below. Your browser fetches two web fonts from Google Fonts, and the company hosting this site sees the ordinary details of your request because that is how a request is served.

A cookie is a small piece of text a website asks your browser to keep and to send back on the next request. It is the mechanism that lets a site recognise a returning visitor, which is useful for a shopping basket or a login and is also the foundation of most tracking.

Cookies are not the only browser storage. A page can also write to localStorage, which persists until it is cleared, to sessionStorage, which lasts until the tab closes, and to IndexedDB, which is a full database. A page can be identified in other ways again, through cache timing, through a service worker, or through the combination of characteristics a browser reveals about itself, which is called fingerprinting.

Naming all of that matters, because a site can truthfully say "we use no cookies" while writing an identifier into localStorage. So, specifically:

You can verify all of that. Open the storage panel of your browser's developer tools on this page and it will be empty, and the network panel will show requests to this domain and to Google Fonts and to nothing else.

There is exactly one script on this site, and it is served from this domain rather than from a content delivery network belonging to somebody else. It is not minified, so it can be read.

It does two things. It turns the navigation into a toggle on a narrow screen, and it fades sections in as they scroll into view. Both are written to fail open, which means that if the script does not load, or JavaScript is switched off, or your browser is old, or you have asked your operating system to reduce motion, every link and every word of the page is still there. Nothing on this site is hidden behind a script.

What the script does not do is the more useful list. It makes no network request of any kind. It reads no cookie and writes none. It touches no storage. It does not measure how far you scrolled, what you clicked, how long you stayed, or what size your window is. It contains no third party code and loads none.

The page uses two typefaces, Frank Ruhl Libre for headings and Sarabun for text. Both come from Google Fonts, which means your browser makes a request to fonts.googleapis.com for the stylesheet and to fonts.gstatic.com for the font files.

That request is made by your browser directly. We do not send anything to Google and we receive nothing back from them. What Google sees is what any web server sees when a browser asks it for a file, which is your IP address, the requested font, your user agent string and the referring page.

Google's published position is that Google Fonts sets no cookies, does not use the requests for advertising, and logs the requests to operate and improve the service. Google is in the United States, so this is a disclosure of your IP address to an overseas recipient in the sense discussed under Australian Privacy Principle 8 in the privacy policy.

Why we have not self hosted them

Self hosting the two font files would remove that request and is the more private option. It is on the list of things to do and it has not been done. Saying so is more useful than quietly leaving the request in place while claiming there are no third parties, which is a common arrangement on privacy focused pages.

If you would rather not make the request at all, block fonts.googleapis.com and fonts.gstatic.com in your browser or extension of choice. The page falls back to Georgia and to your system sans face, the layout does not break, and nothing becomes unreadable.

This site is served by Cloudflare Pages. Like every web host, it records the details of a request in order to answer it, and to absorb the constant background of automated attacks that every public site receives.

These are transient operational logs held by the host on its own retention cycle, measured in days. We do not export them, we do not copy them into a store of our own, and we do not build any profile from them. The host may also serve an automated challenge to a request that matches an abuse pattern, which is a security control rather than a measurement of you.

Consent banners exist because of European law. Article 5(3) of the ePrivacy Directive requires consent before storing information on, or gaining access to information stored in, a user's device, with a narrow exception for what is strictly necessary. That rule is about the act of storing, whether or not the thing stored is personal information, which is why European sites ask about cookies specifically.

Australia has no equivalent provision. What applies here is the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which regulate the handling of personal information rather than the act of writing to a device. A cookie falls within that regime only where it involves personal information, and the analysis then runs through Australian Privacy Principles 3 and 5 on collection and notification rather than through a consent gate.

So the accurate answer is not that Australian law permits us to skip the banner. It is that this site sets nothing at all, which makes the question moot under either regime.

What we would do if that changed

• This notice would be updated before the first cookie was set, not afterwards.
• Anything beyond what is strictly necessary would be off by default and would require an active choice. No pre-ticked box, no "by continuing you agree", no banner where refusing takes more clicks than accepting.
• Each cookie would be listed here by name, purpose, duration and party, rather than by category.
• Refusing would not degrade the site. There is no content here worth gating.

We are aware that publishing this makes a later banner conspicuous. That is the intended effect.

Do Not Track is a header some browsers send to ask sites not to track the visitor. It was never widely honoured and most browsers have removed the setting. We do not track anybody, so the header is respected by default and by construction rather than by policy.

Global Privacy Control is a newer signal with legal force in some jurisdictions, notably California, where it must be treated as a valid opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and there is no advertising or analytics here for the signal to switch off, so a page served to a browser sending it is identical to a page served to one that is not.

Browser blocking. Tracker blockers, content blockers and strict privacy modes will find nothing on this site to block except the Google Fonts request. Blocking that is supported and expected, and the page degrades to system fonts without any other effect.

There is nothing set by this site to clear. The instructions are here anyway, because the useful thing about a cookie notice is usually the part that applies to every other site you visited today.

• Chrome. Settings, then Privacy and security, then Third party cookies for the blocking rules, and Delete browsing data for what is already stored.
• Firefox. Settings, then Privacy and Security. Enhanced Tracking Protection set to Strict, and Cookies and Site Data to clear.
• Safari. Settings, then Privacy, where Prevent cross-site tracking is on by default, and Manage Website Data to clear.
• Edge. Settings, then Cookies and site permissions, and Privacy, search and services for tracking prevention.
• Any browser. A private or incognito window discards cookies and storage when the last window of that session closes.

Blocking cookies globally breaks a lot of ordinary websites, particularly anything with a login. Blocking third party cookies specifically breaks very little and removes most cross site tracking, which is why several browsers now do it by default.

If this notice changes, the effective date and the version at the top of the page change with it. A change that introduces any browser storage will be made before the storage appears, will be flagged at the top of this page for 30 days, and will be reflected in the privacy policy at the same time.

Questions about anything on this page go to [email protected]. If you find a request being made by this site that is not described here, that is a defect rather than an omission, and we would like to know about it. Put "Correction" in the subject line and we will fix the page or fix the site.

ARCVAULT AI PTY LTD is an Australian proprietary company registered in New South Wales. The company details and the escalation route to the Office of the Australian Information Commissioner are in the privacy policy.