Cookie policy

The statement, with a date on it

As at 28 August 2026, in version 1.1 of this site:

• No cookie is set.
• Nothing is written to your browser's local or session storage, or to its internal database.
• No third-party script is loaded. No analytics, no maps, no chat, no CAPTCHA, no social buttons, no advertising pixels.
• Typefaces are served from this same domain. They are downloaded when the site is built and are never requested from an external server, Google's or anyone else's.
• No fingerprinting technique is used to recognise your device.

That is the whole policy. The rest of this page explains why there is no banner, how to verify the above without taking my word for it, and what will happen the day any of this changes.

Why there is no banner

Article 22.2 of Spanish Act 34/2002 requires information and consent before storing or retrieving information on a user's device. Note that the law does not talk about cookies: it talks about storage and retrieval devices, and that reaches local storage, session storage and the reading of browser characteristics in order to identify it. This is my own reading, reasoned from the open wording of the law and from the European Data Protection Board's guidelines on the scope of article 5(3) of Directive 2002/58.

Nothing is stored or retrieved here. Since the triggering condition never arises, there is no consent to ask for, and a banner asking permission for something that does not happen would not inform: it would confuse.

Nor is there any legal obligation to have this page. It is kept for two reasons: because the link sits in the footer of every page and whoever clicks it deserves an answer, and because a dated, verifiable statement is more useful than the absence of information.

How to check it yourself

There is no need to believe this page. In any desktop browser, press F12 and open the developer tools panel:

1. Application (or Storage) · Cookies — should be empty.
2. Application · Local Storage and Session Storage — should be empty.
3. Application · IndexedDB — should be empty.
4. Network: reload the page and sort by domain — every request should go to this domain.

If you find anything that contradicts the statement above, write to ramon@graubo.com and either the page or the website will be corrected, depending on which is wrong.

Exempt technical storage

Article 22.2 has two exceptions: what is strictly necessary to transmit a communication, and what is strictly necessary to provide a service you have expressly requested. Although none is used today, it is worth setting out what would fall there and for how long, so that this page does not have to be rewritten in four languages when the time comes:

• Your browser cache, which keeps images and stylesheets so the site loads faster. Your browser manages it, not this site.
• A language cookie, if the site ever remembers which language you prefer to read in. For that alone, never reused for anything else, and not active today: the language is part of each page's address and does not need storing.

While the site is closed to the public, access is controlled with HTTP basic authentication, which sets no cookies: the credentials are handled by your own browser.

What will happen if traffic is ever measured

There is no analytics of any kind today, and not knowing how many people visit is the price paid for this page. The intention is to install, at some point, analytics that do not use cookies. When that happens, three commitments:

1. This page is updated first, not afterwards. The version number goes up, it is dated, and it is published in all four languages at once. On the day the analytics is deployed, this page will already say so.
2. The tool will be named, along with what it collects and who operates it, with its corporate name and country, and it will also enter the supplier table in the privacy policy.
3. It will only be installed if it is exempt from consent, and the vendor saying it uses no cookies is not enough. It has to meet the conditions of the audience-measurement exemption: a purely statistical purpose, aggregated data, no combining with other processing, no disclosure, no tracking across different sites, a limited identifier lifetime and retention period, and a processing agreement in place. If the chosen tool does not meet them under the exact configuration it is given, then there will be a banner, with the option to refuse as visible and as easy as the option to accept.

And if anything ever were installed that is not exempt — an embedded map, a video from an external platform, a chat widget — it would not load until you consented.

Review of this page

Version 1.3 · 28 August 2026.

It is reviewed in two cases: six months after the site opens, and before installing anything that writes to or reads from your device. European law in this area is in the process of changing, so the date of the statement matters as much as its content: what this page says is what is true on the date shown above.

The four language versions of this page always carry the same number and the same date. If you see a different date in another language, that is an error and it is worth flagging.