The About page promised no third parties would see you. Then we turned on analytics.

The About page on kokkekunst.no (/om) has a short privacy section. Until 30 August 2026, its last paragraph read, in Norwegian, “Alle skrifter og filer serveres fra vårt eget domene. Ingen tredjeparter får se at du er innom.” In English: all fonts and files are served from our own domain, and no third parties get to see that you stopped by.

That was the promise. On 30 August we turned on Cloudflare Web Analytics for the site, and the promise stopped being true.

What changed

The kokkekunst.no site is an Astro site. The commit message about visitor counts puts it plainly: “Web Analytics er slått på i Pages (beacon injiseres ved deploy).” Web Analytics is switched on in Pages, and the beacon is injected at deploy time.

So none of our own code adds the script. Pages inserts it when the site is deployed. That means a visitor’s browser now loads a script from Cloudflare’s servers, not ours. Cloudflare sees the request come in. “No third parties see that you stopped by” no longer held.

The commit message names the problem directly: “Da måtte /om rettes: den lovet «ingen tredjeparter får se at du er innom», og det stemmer ikke lenger.” Then /om had to be fixed: it promised no third parties would see you visit, and that is no longer true.

The odd part: the page already mentioned analytics

The diff shows something worth being honest about. The paragraph just above the broken promise already said the site uses Cloudflare Web Analytics. It explained that the tool counts page views without identifying you and without setting anything in your browser, which is why there is no consent banner.

A code comment at the top of the site’s base layout said the same thing before the change: no tracking beyond Cloudflare Web Analytics, which is cookie-free and so needs no consent banner.

So the page described analytics in one paragraph and promised “no third parties” in the next. The day Pages started injecting the beacon, the page contradicted itself.

How it was found

It was fixed in the same commit that records analytics being switched on in Pages. The switch itself was made in Pages, not in code. The commit does not say who spotted it. It records only that the page had to be fixed and why.

Henning writes no code himself, so the “no third parties” sentence was Claude’s. The mistake is the sentence itself, and the fact that it no longer matched how the site worked.

The fix

The rewritten paragraph says, in Norwegian: fonts, images and everything else are served from our own domain. The one exception is the counting script mentioned above, which loads from Cloudflare. So Cloudflare does see that the request came in, but it builds no profile of you and does not follow you to other sites.

The fix makes three changes:

• It drops the absolute claim (“no third parties”) and replaces it with a stated exception.
• It says what the third party actually sees (that a request arrived), not just that one is present.
• It keeps the limits we can stand behind: no profile, no cross-site following.

The paragraph above got two small edits in the same pass. “Innloggning” became “innlogging” (a spelling fix), and “uten å sette noe i nettleseren din” (without setting anything in your browser) became “uten å lagre noe i nettleseren din” (without storing anything in your browser).

Making the code remember the promise

The other change is in the base layout’s header comment. The old comment said there were no third-party fonts and no embedded third-party scripts. The new one says the beacon is injected by Pages and is the only third-party script on the site, and that /om says so outright and should keep doing so.

That turns the privacy text into something the code points at. The next time someone, human or model, opens the layout to add a script, the comment tells them a public page makes a claim about exactly that.

The same commit, the same pattern

The commit was not only about analytics. Its other half, making the site easier for AI search to read, fixed a related kind of mismatch. Article pages had structured data (JSON-LD) with no author field at all. The commit set author to the organisation, not a person, and explains why: the drafts are machine-written, and naming a human there “ville vært en løgn i feltet maskinene leser først”, which would be a lie in the field machines read first. Responsibility goes in editor.

Both changes deal with the same question: does what the site says about itself match what it does? One is aimed at people reading the About page, the other at machines reading metadata.

What we take from it

A privacy promise is a claim about how the system behaves. When the system changes, the claim can go stale without anyone touching the text. Here the script was injected by Pages at deploy time, not added by code in our repository.

The rule

When a feature changes, search for every text that promises something about it (About pages, privacy sections, code comments, machine-readable metadata) and update them in the same change. If a promise is absolute (“no third parties”, “nothing stored”), check it against what the site actually loads, and replace it with the exception, stated plainly, if it no longer holds.