Current findings
The local candidate includes optional first-party traffic analytics. No visit or interaction event is sent until you choose Allow analytics. Choosing No, thanks keeps it off. The form works either way.
A preference named dariia.analytics-consent.v1 in local storage remembers only “accepted” or “declined”. It has no automatic expiry in this version and remains until you change it or clear site data. It is not a visitor identifier and contains no form text or contact information.
Use Privacy choices in the footer to change your decision. Refusal or withdrawal stops future events; it does not automatically erase records already received. Browser Global Privacy Control and Do Not Track requests keep analytics off. Blocking local storage does not stop the form; a choice can still apply to the current page only.
No advertising pixels, external analytics widgets, session replay, cross-site tracking identifier or service worker is configured. The private owner dashboard uses a necessary HttpOnly, SameSite=Strict cookie, expiring after eight hours and revoked on logout. It is Secure on hosted HTTPS; loopback development uses HTTP.
These legal pages load only their local stylesheets and self-hosted fonts. They contain no scripts, embeds or forms. The main page also uses local images and video files.
This is a description of the reviewed implementation, not a claim that every hosting configuration or external destination is cookie-free.
Application drafts
The form keeps unsent text and its random retry reference in page memory. Site code does not persist an application draft in local storage or a cookie. The analytics preference is separate from an application draft. Closing or reloading the page can lose an unsent request, although a browser may independently restore fields.
A successful submission is stored on the server, not as a browser draft. Clearing browser data does not remove a submitted application. The privacy notice explains the private database and Telegram's reference-only group notification.
Fonts & external services
Nyght Serif and Inter are served from this website through its existing font stylesheet. The reviewed pages do not fetch fonts from Google Fonts or another third-party font service.
Application and optional analytics code contact endpoints on this website. Supabase storage and the Telegram group notification are handled by the server; the browser does not embed their widgets. No additional external analytics subscription or script provider is configured.
Following an external link opens another service, whose own privacy and storage practices apply there.
Browser controls
Your browser may cache website files and offer autofill or session restoration under its own settings. You can review and clear site data, cached files and saved form information through those settings. Those actions do not constitute a server-side deletion request.
The footer's Privacy choices control opens the actual analytics choice on the main page. No choice is preselected as consent. This notice describes the local candidate, not an assertion that the older published site already has these controls.
Before publication
Release audit pending: check the actual public host's response headers, cookies, network requests, browser storage and any security or authentication layer. Add exact names, purposes, providers, lifetimes and choices if any storage is introduced.
Browser storage rules depend on the relevant law and actual purpose. The absence of marketing cookies does not settle the website's other privacy obligations. Ukraine is the confirmed country; EU or other territorial rules require a separate applicability assessment.