What loads before you consent, and what does not.

• First-party session cookies for magic-link authentication.
• Self-hosted web fonts (Besley, Public Sans, IBM Plex Mono) served from the AYVES origin. No third-party font network call is made.
• The AYVES application itself: HTML, CSS and JavaScript served from the AYVES origin.

• Umami analytics · self-hosted, aggregated, no cross-site tracking.
• Sentry error reporting · captures unhandled errors and stack traces so we can fix bugs. Payloads are scrubbed of user PII before send.
• Apache ECharts (Apache-2.0) · the charting runtime used on analysis pages. Loaded from a CDN after consent per Invariant #54.
• Uptime Kuma status widget on the status page.

Your consent choice is stored in a first-party cookie. To change it, use the “Cookies” link in the footer of any page. Clearing your browser cookies for the AYVES domain resets the choice on your next visit.

AYVES treats PECR (UK) and the ePrivacy Directive (EU) as the governing regimes for storage of and access to information on the user's terminal. Analytics + error reporting + external chart runtime require prior, granular, informed consent; essential storage for authentication does not. The load-order discipline is enforced at build time.