Cookies and site storage
Most cookie policies are written to justify a tracking stack that was chosen first. This one is an enumeration, and until 2026-08-27 the enumeration was empty. Google Analytics arrived on that date, loaded on every page and set to store nothing on your device. It now loads only for a visitor who accepts it in the banner, and stores its two cookies for that visitor alone; for anyone else, nothing is sent to Google at all. Those entries sit below with everything else, because "minimal by design" only means something if the list is complete — including the entries that arrived late, and the one line we cannot verify for you, which has its own section.
Everything this site puts on your device
The complete list, by storage mechanism. Each line is a state of the shipped build, not an intention.
- Cookies set by this site
- GOOGLE ANALYTICS ONLY, AND ONLY IF YOU ACCEPT (SEE BELOW)
- Local storage
- ONE ITEM, ONCE YOU CHOOSE: YOUR ANALYTICS CHOICE
- Session storage
- NOT USED
- IndexedDB / Cache Storage
- NOT USED
- Service worker
- NONE REGISTERED
- Analytics vendor
- GOOGLE ANALYTICS 4 — LOADED ONLY IF YOU ACCEPT
- Advertising / retargeting pixels
- NONE
- Third-party embeds
- NONE
There is an analytics account behind this site: Google Analytics 4, property G-2P3Y8YM62Q, added on 2026-08-27 to find out which pages search brings people to. It is not loaded until you accept: before that, and after a refusal, no page requests anything from Google, so nothing is sent to it and nothing on your device is written or read for it. When it does load, Google Consent Mode starts it with all four storage categories denied, and your Accept grants the one for analytics.
If you accept, it stores two first-party cookies, which Google's own documentation gives a default life of two years: _ga, a random identifier that tells one browser from another, and _ga_2P3Y8YM62Q, which keeps the state of a visit. With them the site can count return visits and see how a visit moves between pages. The three advertising categories stay denied whatever you choose, so nothing is ever collected for advertising, and the identifier belongs to a browser, never to a name or an email address.
The choice itself is kept in this site's local storage, under one key, hadal-analytics-consent, holding accepted or rejected. It is the one item stored without asking, because it is strictly necessary to what you asked for: without it the banner would return on every page. It never leaves your browser, and nothing uses it but this site's own script.
Why it is structural, not a promise
A policy sentence can be reversed by one person adding one script tag. Until 2026-08-27 this section argued that the site's Content-Security-Policy made that impossible. On that date exactly that change was made — a Google Analytics tag, and one named host added to the policy to let it load. So the original claim was too strong, and it is corrected here rather than quietly deleted: the policy does not make the change impossible, it makes it deliberate and visible. What the policy still refuses at the browser:
default-src 'self'— everything not named explicitly is refused. The analytics exception is exactly one host inscript-src(www.googletagmanager.com) plus Google's collection endpoints inconnect-srcandimg-src, where a browser that cannot send a measurement otherwise sends it as an image. A second vendor pasted in by mistake is still blocked: the policy names no other host a script may load from, and you can read it in the response headers (§ 03).font-src 'self'— typefaces are served from this origin, so no font CDN sees your IP address.frame-ancestors 'none'andobject-src 'none'— nothing embeds this site, and this site embeds nothing.form-action 'self'— a form on this site cannot post anywhere else, including to a mailing vendor.
The policy also carries Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy that switches camera, microphone and geolocation off for the whole site.
Check it yourself, in about a minute
You should not take a cookie policy on trust, including this one. Open your browser's developer tools on this page and look:
- Storage. Application (or Storage) panel → Cookies, Local Storage, Session Storage, IndexedDB. Before you choose, every one should be empty for this origin: an ordinary Google Analytics install writes
_gaon your very first pageview, and this one does not. After you reject, Local Storage holds the one key for your choice and Cookies holds nothing from Google Analytics. After you accept, Cookies holds exactly the two cookies § 01 names. If you find anything else, this page is wrong. - Network. Reload with the Network panel open. Before you choose, and after you reject, you will see this domain and nothing else. After you accept you will also see
googletagmanager.comandgoogle-analytics.com— that is the measurement § 01 names, and it is the only third party you should find. No font CDN, and no vendor that is not named on this page. - Headers. Click the document request and read the response headers. The Content-Security-Policy is the structural enforcement this page relies on, and there is no
Set-Cookieheader on it.
If you find something this page does not list, the page is wrong and we want to know:contact@hadalinstruments.com. This line read NOT YET PUBLISHED until 2026-08-02, when the domain routes went live — the change is dated rather than smoothed over.
What does leave your browser
What is stored on your device and what leaves it are separate questions. Beyond the requests each page makes to this domain for its own files, this is everything your browser sends:
- The launch-list form, only when you submit it. Your email address, and a name and one answer if you give them, are sent to
/api/waitlist/on this domain. What is stored is what you gave, the moment it arrived, the path on this site you submitted from and whether the notification of the signup went out — no IP address, no user agent, no cookie, and no third-party mailing provider in between. The privacy policy covers what happens to it after that. - Search runs in your browser. The search page downloads its index from this domain, in pieces, and searches it on your device: what you type is not sent anywhere, though which pieces of the index it fetches follows from the words. A search opened from an address such as
/search/?q=…moves the words behind a#as the page opens, and a browser never sends what follows a#, so the analytics below is not given them. - The analytics, only once you accept. Until you accept, the tag § 01 names is not loaded, and no page sends Google anything. Once you have accepted, each page loads it from
googletagmanager.com, and it sends Google a pageview and the events it records by itself as the page is used: time spent on the page, scrolling most of the way down, a click on a link to another site or on a file to download, starting or sending a form, an embedded video playing, and a search term in the address you arrive by, as?s=or?q=can carry one (the search page moves its own, above). Each goes with the page address and the referring page, cut before any?or#, the identifiers in the two cookies § 01 names, and the coarse device and country information Google derives from your browser and your IP address, which Google receives as Hadal's processor. None carries anything typed into a form on this site. The pages of a visit, and later visits from the same browser, are joined to that browser. When you reject, sending stops at once: on that page Google's own opt-out setting stops the tag already loaded, and the page then refuses any further request to Google, even a pageview the tag had prepared before you chose. The same happens at once in any other tab open on this site, and to a page kept for the Back button when you return to it; later pages do not load the tag. - One event, only if you join the launch list and have accepted. When your address is stored, the same tag sends Google an event named
waitlist_signup— a count that a signup happened, plus the page it happened on, cut as above. It carries no email address, no name and no answer: nothing typed into that form is sent to Google, at any point. Like the pageview, it is sent only once you have accepted analytics cookies. A failed or refused signup sends no such event. - Pages fetched in advance, from this domain. In a browser that supports it, holding the pointer on a link to another page of this site, or pressing it, lets the browser fetch and prepare that page so it opens at once. The request goes to this domain, and a page prepared this way loads nothing from Google until you open it.
- Error reports to the hosting network. If a request to this site fails, your browser may report the failure to Cloudflare, which serves the site; § 05 says what is sent.
A correction to this section. From 2026-08-27 the tag loaded on every page for every visitor, with storage denied, and this section said that what it sent before a choice carried no identifier and could not be joined. It carried a random client identifier (for a visitor who went on to accept, the same one the cookie then held) and the device's screen size, platform and its version, processor architecture and language. That sentence was wrong. So, from the same day, was this section's line that a search query was never transmitted, and the search page's that nothing typed was sent anywhere: a search opened from an address such as /search/?q=… sent its words to Google, in the page address and again as a search term. Those pings have stopped, and the changelog dates the correction.
The layer we cannot enumerate for you
Everything above is what this site does, and what the tag it loads on your Accept sends; § 03 says how to watch it. Underneath it is a hosting network, and honesty about the boundary matters more than a tidier page.
The site is served through Cloudflare. Serving a request involves the platform handling it, and a platform's network-security layer can issue a short-lived security cookie of its own — Cloudflare's is named __cf_bm — where bot mitigation is enabled. Any such cookie is strictly necessary to that security function. It is not set by this site's code, is never read by us, and carries nothing about you that we could use even if we wanted to.
Whether one is issued on this deployment depends on platform configuration we have not published, so we are not going to assert either way — the storage panel in your own browser answers that question exactly, for your own visit, which is a better answer than our word.
The network also asks your browser, in headers named Report-To and NEL on its responses, to report requests to this site that fail — a connection that breaks, or an error answer such as a page not found — to Cloudflare's reporting address, a.nel.cloudflare.com. A request that succeeds is not reported. A report names the address that failed and the kind of failure, and reaches Cloudflare from your IP address, as every request does. It is sent by your browser, not by this site's code, and you can read both headers in your own developer tools (§ 03).
The platform also processes and may retain ordinary request metadata in the course of delivering pages, as any host does. An edge log exists as well, kept by the software that serves the site for one purpose — to see which automated crawlers read which pages — and it is built so that a person's visit leaves no IP address, no user agent and no cookie in it: the page, the moment, the response and the referring site, nothing more. Only software that declares itself a crawler is recorded with its network address, so the claim can be checked. We build no profile from either record. The measurement named in § 01 is separate, sent from the browser only for a visitor who accepted, and nothing joins it to either: the edge log keeps no identifier for a person, so even the identifier a visitor who accepted gives Google Analytics has nothing on this side to meet.
The legal position
The Privacy and Electronic Communications Regulations 2003 require consent before storing information on, or reading information from, your device — except where doing so is strictly necessary to provide the service you asked for. Cookies are the usual example, but the rule covers any storage, including the browser storage APIs.
The two Google Analytics cookies are not strictly necessary, so they are stored only with your consent. The banner asks before anything is set or loaded; Accept and Reject are the same button at the same size, one press each; nothing is ticked for you; and Cookie settings withdraws consent as easily as it was given, removing the two cookies from your browser at once. The one item stored without asking, your choice, is the strictly necessary exception: it exists only to remember what you chose.
Personal data — the launch-list address, plus a name and an answer where someone chose to give them; and, for a visitor who accepted analytics cookies, the record Google Analytics keeps of their visits under its identifier and the IP address each pageview is sent from, which Google receives as Hadal's processor — is covered by UK GDPR and set out in the privacy policy. Google Analytics keeps user-level and event-level data for 14 months. Withdrawing stops collection at once, on that page and on any other page of this site still open in your browser, and later pages do not load the tag. To have the visits already recorded under your identifier erased, read the value of your _ga cookie in the storage panel before you withdraw, and send it to privacy@hadalinstruments.com.
What changes when accounts and checkout open
Two strictly-necessary categories arrive with commerce, and they are named here in advance rather than on the day they arrive:
- A session cookie, so that a signed-in account stays signed in between pages. Strictly necessary; no consent required; it does nothing else.
- Checkout cookies set by the payment processor, needed to take a payment securely and to prevent fraud. No checkout exists on this site today, so no such cookie is set here; the seller of record and the processor are named in refunds and cancellation when a checkout opens.
Three commitments bind whatever comes after that:
- No advertising cookie, no cross-site tracking, and no profiling of visitors. When measurement was adopted, on 2026-08-27, this clause held it to a standard published before there was any vendor to apply it to: cookieless, aggregate, no cross-site identifier. On 2026-10-21 that standard changed, and the change is stated here rather than quietly rewritten: a visitor may now choose to let Google Analytics load and set its two first-party cookies, and for a visitor who does not, it does not load at all. Nothing else about the clause moved.
- Any non-essential storage arrives with its consent mechanism, defaulting to off. Never a pre-ticked box, never a "reject" hidden behind an extra click, never consent inferred from scrolling. The analytics banner is the first storage this clause has governed, and it is built to it.
- Every vendor is named on this page before it runs, not after. If you find a name here you have not seen before, it has not yet been switched on.
Status of this document
The policy on this page changes when the build changes. If a future release stores something, the line appears here in the same release — not in the one after it.