OreiaWaking life and dreamsBeta
Open Oreia

Cookies and local storage

Short version: this website stores nothing on your device, so there is nothing to consent to and no banner asking you to. The longer version explains how that was established, because “we value your privacy” is what every banner says and it is not evidence of anything.

What was measured

Rather than reasoning about it, this was measured: a fresh browser profile with no history, driven to this site, then inspected through the browser’s own debugging protocol — which matters, because a page’s own JavaScript cannot see HttpOnly cookies or cookies belonging to another domain, and both are exactly the interesting cases. The check was run again after provoking the anti-abuse challenge on the dream reader, since a third-party challenge script is the most likely thing to store something without anyone deciding it should.

Both times, on every surface a browser has to offer:

  • Cookies — none, from any domain, including ones script cannot read.
  • Local storage — empty.
  • Session storage — empty.
  • IndexedDB — no databases.
  • Cache storage — no caches.
  • Service workers — none registered.

Why there is no consent banner

The rule that produces cookie banners is not the GDPR but §25 TDDG, Germany’s implementation of the ePrivacy Directive. It requires consent before storing information on your device or accessing information already there, whether or not that information is personal data. Its exception, §25(2), covers what is strictly necessary to deliver a service you asked for.

This site does neither the thing that requires consent nor the thing that needs the exception. It stores nothing and reads nothing, so the obligation never arises. A banner here would be asking permission for something that does not happen — and would itself be the first script on the page to want your attention.

Things that are commonly here and are not

  • No analytics. No Google Analytics, no Cloudflare Web Analytics, no Plausible, no Matomo, no PostHog. Nothing counts visits, and there is no dashboard of you anywhere.
  • No advertising or tracking pixels. No Meta pixel, no conversion tag, no tag manager, no remarketing.
  • No Google Fonts. The typefaces are served from this domain. Loading them from Google would send your IP address to Google in order to draw the page; the Munich Regional Court held in January 2022 (LG München I, 3 O 17493/20) that doing so violates the GDPR. So they are not loaded from Google.
  • No embedded video, map or social widget. Nothing on this site is a frame around someone else’s server.

The one third party your browser does contact

On the pages with the free dream reader, focusing the text box loads Cloudflare Turnstile — an anti-abuse challenge that establishes you are a person rather than a script. It is loaded lazily, at the first sign that you intend to use the reader, so simply reading a page here does not fetch it at all.

Turnstile is the reason this page describes a measurement rather than an assumption. It is a third-party script and it would be entitled to store something; measured, it stores nothing. Cloudflare’s own documentation matches that: Turnstile “does not access, store, or transmit user communications, form entries, or other page inputs”, and Cloudflare states it does not use cookies to collect or store information and does not harvest data for ad retargeting. It can be configured to set a clearance cookie; that option is not enabled here, which is what the measurement above confirms.

To do its job it does see technical signals about your browser and your IP address — that is what distinguishing a person from a script consists of. What it replaces is worth weighing: an unprotected AI endpoint, or a sign-up wall in front of a feature whose whole point is that it needs no account. When your answer is checked on the server afterwards, that check deliberately omits your IP address, which Cloudflare treats as an optional field.

Cloudflare also serves this site, so it sees the request that delivers each page — the IP address, the time and the URL — because no host can deliver a page without them. That is described under the privacy policy.

The app is different

Everything above is about this website. The journal itself, at app.oreiathejournal.com, has to remember that you are signed in, and it does that with your browser’s local storage rather than with cookies: a session token, your display preferences, and — in IndexedDB — the key that decrypts your journal, held in a form that scripts on the page cannot read out. All of it is strictly necessary for a journal you are logged into, none of it is analytics, and signing out clears the session. That is also why the app has no banner.

If you find something

This page is a factual claim about software, and software changes. If your browser shows a cookie on this domain that is not explained here, that is a bug in the site or an error on this page, and I would like to know which: hello@oreiathejournal.com.