This site sets
no cookies.
Not essential ones, not analytics ones, not third-party ones. Last updated .
Outrings sets zero cookies, which is why you have not been asked to dismiss a banner — there is nothing to consent to. You can verify it yourself in about ten seconds; the method is below.
Why there is no consent banner
Consent requirements under the ePrivacy Directive and GDPR attach to storing or reading information on your device. A banner exists to collect that consent. With no cookies and no equivalent storage used for tracking, there is nothing to ask about, and a banner would be theatre.
This is a deliberate constraint rather than an oversight. It is also why there is no analytics provider, no tag manager and no advertising pixel anywhere on the site — each of those would bring cookies with it and the banner would follow.
Verify it yourself
Do not take this on trust — it is checkable, and a tool that audits other people's privacy practices should expect to be checked.
- In your browser. Open developer tools, then Application → Storage → Cookies (or Storage → Cookies in Firefox). The list for this origin will be empty.
- From a terminal. Look for a
Set-Cookieheader. There is none:
curl -sI https://outrings.com/ | grep -i set-cookie
That command returns nothing. Run it against most sites and it will not.
What is stored in your browser instead
Two things use localStorage, which is not a cookie: it is never transmitted with
requests, it is not readable by any other site, and clearing site data removes it.
| Key | What it holds | Why | Where |
|---|---|---|---|
| ae-theme | light or dark | So your appearance choice survives a reload | Every page |
| ae-admin-pin | The dashboard access PIN | So the private dashboard does not ask on every visit | /dashboard only |
| ae-dash-tab | Which dashboard tab you last used | So it reopens where you left off | /dashboard only |
None of these identify you, none are sent to the server, and none are used for analytics. The last two only ever exist in the operator's own browser.
How visits are counted without cookies
Counting unique visitors normally means storing an identifier on your device. Instead the server
computes sha256(secret_salt + today's_date + IP + user-agent) and keeps only the
truncated result. Because the date is part of the input, the same person produces a completely
different value tomorrow — countable within a day, impossible to link across days. Raw IP
addresses are never written to disk.
Full detail, field by field, is on the privacy page.
Third parties
There are none. No analytics service, no tag manager, no advertising network, no CDN-hosted fonts or scripts, no embedded video or social widgets. Every asset is served from this origin, so no other party is in a position to set a cookie on you here.
The embeddable badge follows the same rule on your site: it is a plain SVG image inside a link. No JavaScript runs on your page and no cookie is set on your visitors.
If this ever changes
If a cookie ever becomes necessary, this page will say so before it is set, name it, explain what it does, and a consent mechanism will appear for anything that is not strictly necessary. The date at the top is the honest record of when this was last true.
Questions
Is localStorage a cookie?
No, though both store data in your browser. The practical differences: a cookie is sent to the server with every request, localStorage is not; cookies have expiry and domain rules, localStorage persists until cleared. Consent rules generally cover both when used for tracking — which is why it matters that the three keys here are a theme preference and two dashboard conveniences, none of which identify anyone.
Do you use fingerprinting instead?
No. Fingerprinting would be a way of achieving tracking while technically avoiding cookies, and doing it would make the claim on this page dishonest. The daily-rotating hash described above is deliberately built so it cannot follow anyone across days.
What about the API and the MCP server?
Neither sets a cookie either, and neither requires a key or an account.
A response carries Cache-Control and CORS headers and nothing that stores state on
the caller.
See also: Privacy & security · Terms of service · Contact