<p>If your website has a cookie banner, you've already told visitors — and any regulator who checks — that you're sharing their data with someone else.</p><h2>We Wanted None of That Risk on Our Own Site</h2><p>We build secure systems for clients, so running a third-party tracker on our own site never sat right with us. There was nothing to rip out — we never ran Google Analytics, a tag manager, or a session recorder. We just built our own first-party analytics from a blank page.</p><h2>The Whole System: One Beacon, One Worker, One Table We Own</h2><ul><li>A ~2KB beacon on each page that fires two events — page views and button clicks.</li><li>A Cloudflare Worker that receives those events.</li><li>One database table, owned entirely by us — no analytics vendor sitting in the middle.</li></ul><p>Built and shipped in under a day.</p><h2>Why We Don't Need a Cookie Banner</h2><p>We honour Global Privacy Control (GPC) and identify visitors with a per-tab session ID instead of anything personal. No personally identifiable information means no consent is required under UK GDPR — so there's no banner, no "accept all" button, nothing for a visitor to click through.</p><p><strong>The takeaway for any SME:</strong> every third-party script on your site is a decision about whose hands your customers' data passes through, whether you've reviewed it as one or not. Building it yourself isn't the only fix — knowing what's already running is the first one.</p><h2>The One Real Engineering Snag</h2><p><code>navigator.sendBeacon</code> can't preflight, so it's still subject to CORS. Send it a JSON blob and the browser blocks the response. The fix was switching to a <code>text/plain</code> payload, which sidesteps the restriction. One format change accounted for most of the debugging time.</p><h2>Why It Matters More Than It Looks</h2><p>For a company selling secure systems, running zero third-party scripts isn't a compromise — it's the proof. We're not asking customers to trust a claim; we're showing them a site that doesn't hand their data to anyone else in the first place.</p><h2>Check What Your Own Site Is Doing</h2><p>Visit <a href="https://pharoahtechnology.co.uk/products/">pharoahtechnology.co.uk/products</a> and ask us to take a look at what your current analytics setup is actually collecting, and where it's going.</p>