Cookie Policy

1. The short version¶

daemonai.tech sets no cookies. It runs no analytics. There is nothing here to consent to, and nothing to opt out of.

We verified this against the production site, and against the Vercel project configuration, on 8 September 2026:

• A cold request to the site returns no Set-Cookie header at all.
• document.cookie in the browser is empty.
• There is no Google Analytics, no GA4 measurement ID, no Google Tag Manager, and no Vercel Web Analytics. Every JavaScript chunk served by the site was checked.
• /_vercel/insights/script.js returns 404, which is what a site without Vercel Web Analytics enabled returns.
• No analytics script of any kind appears in the served HTML of any page — including Vercel Speed Insights. The script appears zero times across every page we serve.
• No analytics data has ever been collected for this project. The Vercel project reports that it holds no data at all.

Section 4 sets out the Speed Insights position in full, because the platform-level picture is more subtle than the page-level one and we would rather explain it than let it sit unexplained.

This page is a companion to our Privacy Policy, which is the statutory notice given by Daemon AI LLP under section 5 of the Digital Personal Data Protection Act, 2023. Nothing on this page is part of any contract.

---

2. What cookies and similar technologies are¶

A cookie is a small text file that a website asks your browser to store and to send back on later requests. Cookies are how a site remembers that you are logged in, what is in a basket, or which pages you have visited. They are also how advertising networks recognise the same browser across different sites.

Similar technologies achieve some of the same ends without a cookie file: localStorage and sessionStorage, IndexedDB, tracking pixels and beacons, browser fingerprinting (inferring an identifier from the combination of your device's characteristics), and server-side logging keyed to an IP address.

They are worth distinguishing on two axes:

We are describing these categories for completeness. We currently use none of them — not first-party, not third-party, not strictly necessary, not analytics, not advertising, not localStorage, no pixels, no fingerprinting.

---

3. The current state: none¶

We have deliberately not published a table of cookie names, purposes and durations. A table like that, describing a _ga cookie this site does not set, would be false — and falsifiable by anyone who opens their browser's developer tools and looks. We would rather this page be short and correct.

The early-access form does not rely on cookies either. It posts what you type to our own API route, which sends it onward as an email. There is no session, no account and no stored identifier. The mechanism is described in full in section 4 of the Privacy Policy.

---

4. Vercel Speed Insights: provisioned at the platform, never loaded, never collected¶

Our host is Vercel, and some Vercel platform features are provisioned at the project level rather than in our application code. This creates a gap between what the platform could serve and what the site actually loads, and it is worth setting out precisely, because a partial look at it can be read either way.

What is true at the platform level. The Vercel project has a Speed Insights identifier provisioned, and a Web Analytics identifier provisioned. That is why /_vercel/speed-insights/script.js returns 200 when you request it directly. The endpoint exists because the platform allocated it, not because this site uses it.

What is true of the site you are actually served.

• The Speed Insights script appears zero times in the served HTML of any page on daemonai.tech. Nothing loads it. A script that is never referenced is never fetched by your browser and never reports anything.
• /_vercel/insights/script.js returns 404 — Vercel Web Analytics is not enabled.
• The project reports that it holds no data: no analytics data has ever been collected for this site. Not a partial dataset, not a short window — none.

The conclusion, plainly: no analytics runs on this site. The platform provisions endpoints that a page could use; this page does not use them, and nothing has ever been collected through them. Sections 1 and 3 of this page and this section all say the same thing, because they describe the same verified state.

For completeness, since the identifier exists and you may find the responding endpoint yourself: Speed Insights, where a site does load it, collects Core Web Vitals — page performance measurements such as how quickly the largest element renders, how much the layout shifts while loading, and how quickly the page responds to your first interaction. It is cookieless: it sets no cookie and builds no cross-site profile. Its purpose is to tell an operator whether pages are slow, not who the visitor is. We describe it only so that you know what the provisioned-but-unused feature would be. If we ever start loading it, section 7 commits us to updating this page before that change goes live, and section 6 governs what consent would be required first.

---

5. What our host necessarily processes¶

Separately from anything optional, delivering a web page requires the server to receive a request. Our hosting provider, Vercel Inc., therefore processes the ordinary metadata of every request: your IP address, your browser's user agent string, the URL you asked for, and a timestamp.

This is infrastructure, not analytics. It is not a tracking choice we have made; it is what has to happen for a page to reach you at all. We do not receive it, do not retain it, do not receive an analytics feed derived from it, do not combine it with anything you have submitted, and do not use it to profile you. Our position — stated openly in section 5 of the Privacy Policy rather than dressed up as a lawful basis the DPDPA does not contain — is that metadata handled this way is not personal data in our hands.

Vercel is a United States company. This site is served through its Mumbai (bom1) edge location, which is a latency arrangement and not a data-residency guarantee. See section 18 of the Privacy Policy on cross-border transfer, and section 17 for the sub-processor list.

---

6. Why any future analytics will be consent-gated¶

Indian law makes this simple, and in one respect stricter than the frameworks most cookie banners were designed for.

The Digital Personal Data Protection Act, 2023 has no "legitimate interests" ground. Personal data may be processed only with consent under section 6, or for one of the enumerated "certain legitimate uses" under section 7. There is no balancing test under which an organisation may run analytics because it considers its own interest in measurement to outweigh your privacy.

The practical consequence is direct: if we introduce analytics, tracking, or any similar technology that processes personal data, it must be consent-gated, and the consent must be obtained before the technology loads — not after the page has already reported on you. A banner that says "by continuing to browse you accept cookies" while the tags have already fired is not consent by clear affirmative action, and would not be valid here.

If we ever add such technology, we commit to:

1. updating this page before the change goes live, naming the vendor and what it collects;
2. blocking the technology from loading until consent is given by clear affirmative action, with refusal as easy as acceptance and no pre-ticked boxes;
3. making withdrawal of that consent as easy as giving it, in line with the Privacy Policy; and
4. adding the vendor to our sub-processor list at /legal/subprocessors.

Children. We do not track children. Section 9(3) of the DPDPA prohibits tracking, behavioural monitoring and targeted advertising directed at children, and parental consent does not cure it — there is no permission a Data Fiduciary can obtain that makes that conduct lawful. It is not, however, an absolute prohibition, and we will not describe it as one: section 9(4) empowers the Central Government to exempt prescribed classes of Data Fiduciary and prescribed purposes from section 9(1) and section 9(3) by notification, and section 9(5) provides a further exemption power tied to an age threshold. So carve-outs exist. None of them matters here, because we do none of these things — for children or for anyone.

<!-- GDPR / ePrivacy: Art 5(3) ePrivacy Directive storage-and-access consent, the strictly-necessary exemption, and a consent-management platform record would go here if EU or UK visitors come into scope --> <!-- CCPA/CPRA: an opt-out-of-sale-or-sharing signal, including Global Privacy Control handling, would go here if California residents come into scope -->

---

7. Our commitment to re-verify this page¶

A cookie policy is only worth anything if it matches what the site actually does on the day you read it.

We will re-verify and update this page whenever the site's analytics or tag configuration changes, and in any event before any release that adds a third-party script, a tag manager, an A/B testing tool, an embedded video or map, a chat widget, or any host-level analytics feature.

Verification means checking, against production: the response headers for a Set-Cookie header; document.cookie in a fresh browser profile; the served JavaScript for analytics identifiers; the served HTML of every page for any analytics script reference; the /_vercel/ endpoints; and whether the hosting project holds any collected analytics data. The last of those is the one most easily skipped, and it is the one that settles the question. The date of the most recent verification is the last updated date recorded at the top of this page.

---

8. Controlling cookies in your browser¶

Since this site sets none, there is nothing here for you to block. The controls below are for the rest of the web, and we mention them because a cookie policy that does not tell you where the controls are is not being much help.

Every major browser lets you view and delete stored cookies and site data, block third-party cookies, block all cookies for a specific site, and clear everything on exit. The settings are usually found under Privacy and security, Cookies and site data, or Manage website data, depending on the browser. Private or incognito windows discard cookies and site data when the window closes.

Blocking all cookies everywhere will break sign-in on many sites. It will not break anything here.

---

9. Contact¶

Questions about this page, or about anything else to do with personal data:

We use one address for everything, including grievances under section 13 of the DPDPA. Our Grievance Officer, service levels (acknowledgement within 2 working days, resolution within 15 days) and the route of escalation to the Data Protection Board of India are set out in section 10 of the Privacy Policy.

This page is available in English. If you would rather have it, or the Privacy Policy, in any language listed in the Eighth Schedule to the Constitution of India, write to contact@daemonai.tech and we will provide it. No reason needed, no charge.