A short list of cookies on this site. No advertising, no profile building, no data sold. You can change your mind at any time from the footer.
In one paragraph: This site (norcube.com) and our documentation site (docs.norcube.com) set two kinds of cookies. Strictly necessary ones (your consent choice, basic CDN security) — always on; we cannot offer a working website without them. Analytics ones (one PostHog cookie, EU-hosted in Frankfurt) — only set if you click Accept on the banner. The banner and your choice are shared across both sites, so accepting or declining once covers norcube.com and docs.norcube.com together. There are no advertising cookies, no profile building, no data sold. You can change your mind at any time using the "Cookie preferences" link in the footer.
A cookie is a small text file a website asks your browser to store. Your browser sends it back to that website on every subsequent request, which lets the site remember things between visits (your login, your language, your consent choice, that you have been here before, …).
The EU's ePrivacy Directive (the so-called "Cookie Law") requires us to be upfront about what cookies we set and to get your consent for anything beyond strictly necessary.
Both our marketing site (norcube.com) and our developer documentation (docs.norcube.com) use the same cookie setup. The consent cookie and the analytics cookie are written on the parent domain (.norcube.com), so one choice covers both sites and a returning reader is recognised as the same visitor across them.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
cc_cookie |
Norcube (Jetlio, s.r.o.) | Remembers which cookie categories you accepted, so the banner does not reappear (shared across norcube.com and docs.norcube.com) |
6 months |
__cf_bm |
Cloudflare | Distinguishes humans from bots at the CDN edge — required for security | 30 minutes |
_cfuvid |
Cloudflare | Lets Cloudflare apply rate-limit rules per session — security | Session |
These cookies are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are strictly necessary to deliver the service you asked for (i.e. to securely serve a webpage).
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
ph_phc_uZoPx…_posthog |
PostHog (EU-hosted, Frankfurt) | A random visitor identifier (distinct_id) plus minimal session info, so we can see which pages help readers and where they get stuck. Written on .norcube.com so it is shared between the marketing and docs sites |
12 months |
PostHog is configured with auto-capture disabled and session recordings disabled — we only capture page views and the consent decision itself. The PostHog cookie does not contain your name, email, IP address, or any direct identifier; just a random ID. Analytics requests are sent through our own t.norcube.com endpoint, a thin reverse proxy in front of the EU-hosted PostHog instance (it keeps ad-blockers from silently dropping the data, and no request ever leaves the EU). We hold the EU-hosted PostHog instance under a Data Processing Agreement, listed on the subprocessors page.
If you click Decline, no analytics cookie is ever set, and no analytics data is sent to PostHog.
When you log in to the Norcube application, one additional cookie is set:
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
jds_refresh_token |
Norcube | Keeps you signed in. Holds a signed refresh token (JWT). Set as HttpOnly + Secure + SameSite=Lax, so JavaScript cannot read it and other origins cannot send it. |
24 hours (re-issued on each refresh) |
This cookie is strictly necessary: without it you cannot stay signed in. It is not used for analytics or marketing in any way.
Product analytics in the app does not use cookies or local storage. Our analytics tool (PostHog, EU-hosted) is configured in memory-only mode inside app.norcube.com, so event data is held in the JavaScript runtime only and nothing is written to your browser's terminal equipment. This keeps in-app analytics outside the scope of the ePrivacy "cookie law" (Art. 5(3)) — no separate consent banner is needed for it. The processing itself runs under our legitimate interest in improving the product (GDPR Art. 6(1)(f)), and you can object via the Disable product analytics toggle in account settings.
The product also stores small amounts of UI state in localStorage (your last-opened project, table sort order, etc.). These are stored locally in your browser, never sent to a server, and you can clear them via your browser's "clear site data" tool.
We don't set additional CSRF-token cookies. Instead we use two GDPR/ePrivacy-friendly browser features:
SameSite=Lax, so a third-party site cannot cause your browser to send it on a state-changing POST it didn't initiateThis achieves the same protection as a CSRF token without adding more cookies.
DNT: 1 header, our analytics tool is configured to respect it and will not capture data even if you previously acceptedClearing cookies on the product domain (app.norcube.com) will log you out.
When we change which cookies are set (adding, removing, or replacing), we:
We will never silently start setting a new tracking cookie.
Email [email protected]. For privacy generally, see the privacy policy.