Cookie notice

This website sets no cookies. It writes nothing to local storage, nothing to session storage and nothing to IndexedDB. There is no analytics package, no tag manager, no advertising pixel, no session recorder, no heat map, no social embed and no consent banner.

One request does leave your browser and reach somebody else. Two typefaces are fetched from Google Fonts, which discloses your internet protocol address to Google at that moment. That single request is the entire third party surface of this site, and the rest of this page exists to describe it honestly rather than to bury it.

A cookie is a small text file that a website asks your browser to store and to send back on later requests. It is the oldest way of making a stateless protocol behave as though it remembers you, and it is the reason a shopping basket survives a page load.

The word has since become shorthand for a much wider family of storage and identification techniques, and a notice that discusses only cookies while a site uses the rest of them is misleading by omission. The wider family includes at least the following.

• Local storage and session storage. Larger key and value stores in the browser. Local storage persists until cleared. Session storage disappears when the tab closes.
• IndexedDB. A structured database in the browser, capable of holding a great deal.
• The HTTP cache. Copies of files kept so a page loads faster on a second visit. Cache timing has been used as a covert identifier.
• Pixels and beacons. A tiny image or a script request whose only purpose is to tell a third party that you loaded a page.
• Fingerprinting. Building a probabilistic identifier from fonts, screen size, time zone, hardware and browser behaviour, without storing anything at all.
• Server logs. Not on your device, but they contain your address and what you asked for.

This notice covers all of it, because the honest question is not whether a site sets a cookie. It is whether the site can tell that you were here before, and whether it tells anybody else.

This website sets nothing. Every page on ailaw.im is a static file. There is no server side application, no session, no login, no basket, no preference to remember and no consent state to record, so there is nothing for a cookie to do.

You can verify all of that. Open the developer tools in your browser, look at the storage and network panels, and reload the page. Everything above is observable in about thirty seconds, which is a better assurance than a paragraph of ours.

There is one script on this website. It is served from this domain, it is about one hundred lines, and it does exactly two things.

• It sets an attribute on the page so the stylesheet can collapse the navigation into a button on a narrow screen, and it opens and closes that menu when the button is pressed.
• It sets a second attribute so that sections can fade in as they scroll into view, and only after checking that your browser supports the observer it uses and that you have not asked for reduced motion.

Both behaviours fail open. If the script does not load, if it is blocked, or if your browser is older than the features it uses, every section of every page is fully visible and every navigation link is present in the header. Nothing on this site is hidden behind working JavaScript.

The script makes no network request, reads no cookie, writes no storage and sends nothing anywhere. You can read it at /pinpoint.js, which is the whole file with its comments.

This is the one place where something leaves your browser and reaches a third party, so it gets its own section rather than a footnote.

The pages request two typefaces, Vollkorn and Overpass Mono, from Google Fonts. Your browser fetches a small stylesheet from fonts.googleapis.com and then the font files themselves from fonts.gstatic.com.

What Google receives

Why the fonts are not self hosted

They could be, and self hosting would remove this disclosure entirely. It is on the list of things to do, and this notice will be corrected on the day it happens. Saying that plainly is better than presenting a convenience as a considered decision.

How to prevent it

• Block the two Google Fonts domains in a content blocker or an extension. The site remains completely usable. Text falls back to Georgia and a system monospace, the layout is unchanged, and nothing breaks.
• Disable web fonts in your browser settings, where your browser offers it.
• Use a browser or profile configured to block third party requests generally.

Nothing on this site detects, discourages or reacts to a blocked font.

Server logs are not stored on your device, so strictly they are outside the subject of a cookie notice. They are here because they are the only other place a record of your visit exists, and leaving them out would make this page technically accurate and practically misleading.

The static files that make up this site are served by a hosting and content delivery provider. Like every web server, it records requests. A log line ordinarily contains the time, the internet protocol address the request came from, the path requested, the response status, the user agent and the referring page.

• Those logs are held by the provider, on its own retention schedule, not on ours.
• We do not routinely read them, we do not export them, we do not join them to any other data and we do not build a profile from them.
• They exist so that a provider can operate a service, absorb an attack and investigate abuse.

An internet protocol address can be personal information under Australian law where an individual is reasonably identifiable from it, alone or in combination with other information. It is treated as personal information in the privacy policy for that reason.

Almost every website of this kind carries an analytics package. This one does not, and the reason is worth stating.

Analytics answers questions about aggregate behaviour, and to do it a script watches an individual. For a company with nothing to sell, no funnel to optimise and no advertising to attribute, the only genuine benefit is curiosity about how many people read a page. That is not a good enough reason to load a third party script into a browser belonging to somebody who did not ask for it.

There is a second reason specific to this company. The intended customers are law practices, and a practitioner reading this page may be doing so while thinking about a client matter. A site that reported that visit to an analytics vendor would be a poor advertisement for a company asking to be trusted near legal documents.

If measurement is ever added, it will be a first party, cookieless, aggregate count with no cross site component, this page will describe it before it goes live, and the privacy policy will list the recipient in its recipients table.

There is no consent banner on this website, and the absence is deliberate.

The banner most people recognise comes from European law, principally the ePrivacy Directive, which requires consent before information is stored on or read from a device except where strictly necessary. Australia has no direct equivalent. The obligations that apply to this company are in the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

• Australian Privacy Principle 3 permits collection of personal information only where reasonably necessary for a function or activity of the entity, by lawful and fair means. We collect nothing through this website, which satisfies it by subtraction rather than by argument.
• Australian Privacy Principle 5 requires notification of the matters listed in it at or before collection. This page and the privacy policy are that notification.
• The Commissioner's guidance treats identifiers stored on a device as personal information where an individual is reasonably identifiable. Storing none avoids the question entirely.

A banner asking permission to do nothing would be theatre. It would also train readers to click through consent dialogues without reading them, which is a small harm that the industry has inflicted at very large scale. If this site ever stores anything that is not strictly necessary, consent will be sought properly, before the storage happens, with a genuine option to decline that leaves the site fully usable.

Even though this site stores nothing, you may want to control what other sites store. Every major browser has the controls, and they are in roughly the same place in each.

Blocking everything on this site costs you nothing. There is no feature here that depends on storage, so nothing degrades.

Two browser signals are worth mentioning, because a notice that ignores them is usually hiding something.

Do Not Track

Do Not Track is a header a browser can send asking sites not to track the person using it. It was never given legal force in Australia and most sites ignore it. This site does not need to honour it, because there is nothing here that tracks anybody with or without the header.

Global Privacy Control

Global Privacy Control is a later signal, and in some jurisdictions it is a legally effective opt out of the sale or sharing of personal information. This company does not sell personal information and does not share it for cross context behavioural advertising, so there is nothing for the signal to switch off. If that ever changes, the signal will be honoured and this section will say how.

The commitments in this notice are only worth something if a change to them is visible.

• If this website ever sets a cookie, uses storage, adds analytics or adds any third party script, this page will be updated before the change goes live, not afterwards.
• The effective date and version in the header of this page will change with it, and a note will sit at the top of the page for at least 30 days.
• Where consent is genuinely required, it will be sought before anything is stored, and declining will leave the site fully usable.
• Any new recipient of personal information will also appear in the recipients table in the privacy policy, which is the single authoritative list.

Previous versions of this notice are not published as separate pages, but they are kept. If you want to know what this page said on a particular date, ask and we will send you that version.

Questions about anything on this page go to hello@ailaw.im. Put Privacy request in the subject line if you want a formal answer within 30 days, or anything sensible if you just want to ask.

If you think this page is wrong, that is a defect and we want to hear about it. Tell us what you observed and how, and we will either correct the page or explain why the observation shows something different from what it appears to show. We will not argue with a network trace.

Entity: AI-LAW PTY LTD, an Australian proprietary company, Western Australia. ACN 698 421 608. ABN 23 698 421 608.

We do not publish a postal address. If a document has to be served, the company's registered office is recorded against ACN 698 421 608 on the register maintained by the Australian Securities and Investments Commission, which is the address with legal effect for service.

You can also complain directly to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au. There is no fee and you do not need our agreement.