What this site collects, and what it does not.

The short version

If you reject analytics, or simply never answer the question, this site writes nothing to your device except the record of that decision. We do not sell anything, do not run ads, and do not build a profile of you. What follows is the long version, written to be checked rather than skimmed.

Who is responsible

insdash, Zürich, Switzerland — insdash.io@gmail.com.

We are a small studio, and the person who built this site answers anything you write to us about it. We have not appointed a data protection officer; at this size, holding this little, neither Swiss nor EU law requires one.

What happens when you just read a page

Two things, both before you have chosen anything.

Hosting. The site is static — pages are built in advance and served by GitHub Pages (GitHub, Inc., United States). Like any web server, GitHub’s receives and logs the request: IP address, time, page, browser, referring page. That happens before any of our code runs, we cannot switch it off, and GitHub does not pass those logs on to us.

Fonts and icons. Every page loads its typefaces and its icon font from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Your browser requests those files directly, so your IP address reaches Google on every page view, whatever you answered about analytics. This one is on us rather than on you: serving the files from our own domain would remove that third party, and it is on the list.

Analytics, and the choice you were given

We use Google Analytics 4 (property G-795EK5W2DW) to see which work people actually read. It is off until you allow it.

Before the tag loads, this site sets Google’s Consent Mode to deny storage. So unless you press Accept:

• no analytics cookies are written to your device
• your IP address is truncated before storage (anonymize_ip)
• advertising storage and personalisation stay denied — those stay denied permanently, whatever you choose, because we do not run ads or build audiences

If you accept, Google Analytics writes the cookies listed below and we get aggregate numbers: pages opened, approximate location by country and city, device type, and where visitors arrived from. We never see who you are. We do not export it and do not combine it with anything else.

If you reject, or never answer, the tag stays in denied mode — but it does still load, and Google receives one cookieless request from your browser carrying your IP address and the page you are on. That is how the tag reports “no consent here”. It is worth saying plainly: rejecting means no cookies and no persistent identity, not zero contact with Google.

What is stored on your device

Name	Set by	Purpose	Lifetime
_ga	Google Analytics, only after you accept	Distinguishes one browser from another	2 years
_ga_G-795EK5W2DW	Google Analytics, only after you accept	Keeps session state for the property	2 years
analytics_consent	This site	Remembers whether you accepted or rejected	6 months

analytics_consent is browser storage rather than a cookie, which means it is never attached to a request and never leaves your device — not to us, not to anyone. It holds one word and a date. It expires after six months, at which point the bar asks again, because a decision made once should not stand for ever.

Older Google tags also used _gid and _gat. We do not set them, but if your browser still carries one from a previous visit, rejecting clears those too.

Changing your mind

Cookie settings, in the footer of every page, reopens the consent bar. Press Reject there and we switch analytics storage back to denied immediately and delete the _ga cookies already on your device. It is one click — the same one click that accepting was. Withdrawing consent must not be harder than giving it, and here it is not.

If you email us

The address on this site is a plain mailto: link. There is no form and nothing is submitted through the site, so an email to us is an ordinary email: it reaches a Google-hosted mailbox, and Google processes it as our mail provider.

We keep project correspondence for as long as the engagement runs, and afterwards for as long as Swiss bookkeeping rules require. Enquiries that do not turn into work are deleted once they are no longer of any use.

Embedded content on project pages

Two case studies embed material hosted elsewhere — a Figma prototype on the A Fatt study, and a GitHub badge image from shields.io on menuGen. Opening those pages contacts those providers directly, and they may set their own cookies under their own policies.

They are page content rather than analytics, so they sit outside the consent bar. If you would rather not load them, do not open those pages.

Where the data goes

Hosting, analytics, fonts, icons and mail are all United States providers. Switzerland recognises transfers to US companies certified under the Swiss–US Data Privacy Framework, and the EU–US framework covers visitors from the EEA on the same basis. Google and GitHub (Microsoft) are certified under those frameworks.

Your rights

Under the Swiss Federal Act on Data Protection, and under the GDPR if you are in the EU or EEA, you can ask for access to what we hold about you, correction, deletion, restriction, a portable copy, and you can object to processing.

In practice we hold almost nothing that identifies anyone, so most requests will get the answer “we have nothing on you” — which we will say plainly rather than sending you a form. Write to insdash.io@gmail.com and we will answer within 30 days.

If you are not satisfied, you can complain to the Federal Data Protection and Information Commissioner in Switzerland, or to the supervisory authority where you live in the EEA.

Changes to this policy

The date at the top is the one that matters. If we ever add something that collects more than what is described here, we will ask for consent again rather than quietly widening what you already agreed to.