Cookies and site storage
Most cookie policies are written to justify a tracking stack that was chosen first. This one is an enumeration, and until 2026-08-27 the enumeration was empty. It is no longer: this site now runs Google Analytics, configured so that it stores nothing on your device. That entry sits below with everything else, because "minimal by design" only means something if the list is complete — including the entry that arrived late, and the one line we cannot verify for you, which has its own section.
Everything this site puts on your device
The complete list, by storage mechanism. Each line is a state of the shipped build, not an intention.
- Cookies set by this site
- NONE
- Local storage
- NOT USED
- Session storage
- NOT USED
- IndexedDB / Cache Storage
- NOT USED
- Service worker
- NONE REGISTERED
- Analytics vendor
- GOOGLE ANALYTICS 4 — COOKIELESS
- Advertising / retargeting pixels
- NONE
- Third-party embeds
- NONE
There is an analytics account behind this site: Google Analytics 4, property G-2P3Y8YM62Q, added on 2026-08-27 to find out which pages search brings people to. It runs with Google Consent Mode denying all four storage categories before the tag initialises, so it writes no cookie and reads none. No visit is attributed to a person, no session is stitched to another session, and no profile exists to be sold — without an identifier on your device, none can be built.
Why it is structural, not a promise
A policy sentence can be reversed by one person adding one script tag. Until 2026-08-27 this section argued that the site's Content-Security-Policy made that impossible. On that date exactly that change was made — a Google Analytics tag, and one named host added to the policy to let it load. So the original claim was too strong, and it is corrected here rather than quietly deleted: the policy does not make the change impossible, it makes it deliberate and visible. What the policy still refuses at the browser:
default-src 'self'— everything not named explicitly is refused. The analytics exception is exactly one host inscript-src(www.googletagmanager.com) plus Google's collection endpoints inconnect-src. A second vendor pasted in by mistake is still blocked — and is caught earlier than that, because the same one-host allowlist is enforced when the site is built.font-src 'self'— typefaces are served from this origin, so no font CDN sees your IP address.frame-ancestors 'none'andobject-src 'none'— nothing embeds this site, and this site embeds nothing.form-action 'self'— a form on this site cannot post anywhere else, including to a mailing vendor.
The policy also carries Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy that switches camera, microphone and geolocation off for the whole site.
Check it yourself, in about a minute
You should not take a cookie policy on trust, including this one. Open your browser's developer tools on this page and look:
- Storage. Application (or Storage) panel → Cookies, Local Storage, Session Storage, IndexedDB. Every one should be empty for this origin. This is the check that matters most now that analytics runs: an ordinary Google Analytics install writes
_gahere on your very first pageview. If you find one, this page is wrong. - Network. Reload with the Network panel open. You will see this domain, plus
googletagmanager.comandgoogle-analytics.com— that is the measurement § 01 names, and it is the only third party you should find. No font CDN, and no vendor that is not named on this page. - Headers. Click the document request and read the response headers. The Content-Security-Policy is the structural enforcement this page relies on, and there is no
Set-Cookieheader on it.
If you find something this page does not list, the page is wrong and we want to know:contact@hadalinstruments.com. This line read NOT YET PUBLISHED until 2026-08-02, when the domain routes went live — the change is dated rather than smoothed over.
What does leave your browser
Storing nothing on your device is not the same as receiving nothing. The complete list of what this site transmits:
- The launch-list form, only when you submit it. Your email address is sent to
/api/waitlist/on this domain. What is stored is the address, a timestamp, and the path on this site you submitted from — no IP address, no user agent, no cookie, and no third-party mailing provider in between. The privacy policy covers what happens to it after that. - Search runs entirely in your browser. The search page downloads an index from this domain and queries it locally. Your query is never transmitted anywhere, because there is no search server to transmit it to.
- The analytics pageview, on every page. The tag § 01 names loads from
googletagmanager.comand sends Google a pageview: the page address, the referring page, and the coarse device and country information Google derives from your IP address, which Google receives as Hadal's processor. Because consent is denied before the tag starts, the ping carries no identifier — so pings cannot be joined to each other, to a session, or to you. - One event, and only if you join the launch list. On a successful signup the same tag sends Google an event named
waitlist_signup— a count that a signup happened, plus the page it happened on, which the tag attaches by itself. It carries no email address, no name and no answer: nothing typed into that form is sent to Google, at any point. Like the pageview it is cookieless and carries no identifier, so it cannot be tied to you or joined to any other visit. A failed or refused signup sends nothing at all. - Nothing else. No other page on this site initiates a background request while you read it.
The layer we cannot enumerate for you
Everything above describes code we wrote and can show you. Underneath it is a hosting network, and honesty about the boundary matters more than a tidier page.
The site is served through Cloudflare. Serving a request involves the platform handling it, and a platform's network-security layer can issue a short-lived security cookie of its own — Cloudflare's is named __cf_bm — where bot mitigation is enabled. Any such cookie is strictly necessary to that security function. It is not set by this site's code, is never read by us, and carries nothing about you that we could use even if we wanted to.
Whether one is issued on this deployment depends on platform configuration we have not published, so we are not going to assert either way — the storage panel in your own browser answers that question exactly, for your own visit, which is a better answer than our word.
The platform also processes and may retain ordinary request metadata in the course of delivering pages, as any host does. An edge log exists as well, kept by the software that serves the site for one purpose — to see which automated crawlers read which pages — and it is built so that a person's visit leaves no IP address, no user agent and no cookie in it: the page, the moment, the response and the referring site, nothing more. Only software that declares itself a crawler is recorded with its network address, so the claim can be checked. We build no profile from either record. The measurement named in § 01 is a separate, client-side pageview; none of these are joined, and none carries an identifier that could join them.
The legal position
The Privacy and Electronic Communications Regulations 2003 require consent before storing information on, or reading information from, your device — except where doing so is strictly necessary to provide the service you asked for. Cookies are the usual example, but the rule covers any storage, including the browser storage APIs.
This site stores nothing at all, so there is no consent to collect and no banner to dismiss. Personal data — the launch-list address, plus a name and an answer where someone chose to give them, and nothing else — is covered by UK GDPR and set out in the privacy policy.
What changes when accounts and checkout open
Two strictly-necessary categories arrive with commerce, and they are named here in advance rather than appearing in a banner on the day:
- A session cookie, so that a signed-in account stays signed in between pages. Strictly necessary; no consent required; it does nothing else.
- Checkout cookies set by the payment processor, needed to take a payment securely and to prevent fraud. No checkout exists on this site today, so no such cookie is set here; the seller of record and the processor are named in refunds and cancellation when a checkout opens.
Three commitments bind whatever comes after that:
- No advertising cookie, no cross-site tracking, and no profiling of visitors. Measurement WAS adopted, on 2026-08-27, and this clause is the standard it was held to: cookieless, aggregate, no cross-site identifier. It was published before there was any vendor to apply it to, which is the only reason it counts for anything now.
- Any non-essential storage arrives with its consent mechanism, defaulting to off. Never a pre-ticked box, never a "reject" hidden behind an extra click, never consent inferred from scrolling.
- Every vendor is named on this page before it runs, not after. If you find a name here you have not seen before, it has not yet been switched on.
Status of this document
The policy on this page changes when the build changes. If a future release stores something, the line appears here in the same release — not in the one after it.