Cookie Policy | Nordva Launch

The short version: nothing Nordva Launch puts on your site uses advertising cookies, third-party cookies or cross-site tracking. On our own marketing site we run one advertising tag, Google Ads, to learn which of our ads lead to a purchase; in the EEA, the UK and Switzerland it sets no cookie (section 1). On our own sites, cookies keep you signed in to the dashboard, and on launch.nordva.dev and the public demo at app.nordva.dev/demo/ our own analytics keeps a random visitor id in a first-party cookie for visitors outside the EEA, the UK and Switzerland. Inside them we ask first, with a small banner, and store nothing unless the answer is yes. Everything else is a small preference in your browser’s local storage.

On your site, our waitlist, feedback and notification embeds set no cookies. The analytics script can keep a random visitor id in a first-party cookie, but only when the tracking mode you choose allows it for that visitor. Section 2 lists every name, and you can copy it into your own cookie policy.

1. Our own sites

Where	What	Why	How long
Dashboard `app.nordva.dev`	Session cookies set by Clerk, our sign-in provider (`__session`, `__client_uat`, and `__client` on `clerk.app.nordva.dev`)	Keep you signed in. Strictly necessary.	Until you sign out or the session expires
Dashboard	Local storage: `nordva_onboarding_done` and dismissed-hint flags	Remember that you finished or dismissed the getting-started checklist	Until you clear site data
Dashboard	Local storage: `nordva:project`	Which of your projects you had open	Until you clear site data
Dashboard	Local storage: `nordva:insights-period:<project id>`	The timeframe you last picked on Insights, per project	Until you clear site data
Dashboard, while signing up	Local storage: `nordva:signup_source`	How you found us, so we know which channels work: a `ref` tag, UTM values, the hostname of the site that linked to us, the first page you saw, and the random visitor id in our `nv_vid` cookie if your browser already allowed it. It reaches us once, when your account is created, and becomes one "signup" event in our own analytics	Removed when your account exists, or after 7 days
`launch.nordva.dev` and the public demo at `app.nordva.dev/demo/` (not the hosted `/log/` and `/waitlist/` pages, whose visitors belong to our customers, and not the signed-in dashboard, which sends only one "signup" event when an account is created and one "signin" event a day)	Our own analytics (`e.nordva.dev/v1/s.js`, `auto` mode). Visitors outside the EEA, the UK and Switzerland: the first-party cookies `nv_vid`, `nv_sid` and `nv_ft`, described in section 2. Visitors inside them are asked by a small banner: nothing is stored unless they say yes, and their answer is kept in `nv_consent` for 180 days. Browsers with Global Privacy Control are never asked and get no cookie. Our own browsers carry `nordva:ignore` in local storage (section 2), so our visits are not counted. Each page view sends the page's path without the query string, the hostname of the site that linked you, UTM values and the window width; our server adds the city it is sent from and the browser, system and device type. No IP address or full user agent is stored	See which pages people read, where visits come from, and how many visitors come back	Cookies as in section 2; page views 90 days
`nettsider.nordva.dev`, the company's site for its website service	Our own analytics in its strict cookieless form (`data-cookieless`, section 2): no cookie and no browser storage is written or read, and no visitor or session id is made, for anyone, anywhere. Each page view sends the same things as above, without an id	See which pages people read and where visits come from. A request sent through the form there is stored in our own project, as described on that site's privacy page	Nothing on your device; page views 90 days
`launch.nordva.dev`; on `app.nordva.dev` (signed in) once per browser session when the app opens, and on the Billing page when you start or finish paying for a plan	The Google Ads tag (`googletagmanager.com/gtag/js`), from Google. Outside the EEA, the UK and Switzerland it may set Google’s first-party cookies `_gcl_au` (and `_gcl_aw` when you arrived from one of our ads) on `nordva.dev`. Inside them, and in any browser with Global Privacy Control, it sets no cookie and sends only cookieless signals (Google Consent Mode). Ad personalisation is off everywhere, so no remarketing lists are made. In the app it reports only that the app was opened (as `app.nordva.dev/`, never the page you are on), that a checkout started with the plan's price, and after a purchase the amount before tax, the currency and an order id; nothing about you or your projects	Learn which of our Google ads lead to a sign-up or a paid plan, and what it was worth. A click on a sign-up or plan button is reported as a sign-up	Google’s cookies up to 90 days; Google keeps its data under its own terms
`nordva.dev`, `launch.nordva.dev` and `nettsider.nordva.dev`; not the dashboard	Cloudflare Web Analytics (`static.cloudflareinsights.com/beacon.min.js`), added by Cloudflare, which hosts these sites. Each page load sends Cloudflare the page address, the referring page, the browser string and how quickly the page loaded. Cloudflare states it sets no cookie, uses no browser storage and does not fingerprint visitors	See total page views, sources, countries and page speed	Nothing on your device; Cloudflare keeps its data under its own terms
`launch.nordva.dev/demo/site/`, the users' side of the demo	Our real waitlist, feedback, changelog and notification widgets run on this page, but every request they make to our API is answered inside your browser with example data, so what you type or click there is never sent to us. The changelog widget keeps what it keeps on any site (section 2) in local storage on `launch.nordva.dev`: `nordva_changelog_opened` and `nordva_changelog_announced`, and `nordva_changelog_client` only after you react to an entry. Our own analytics counts the visit as on every page	Show what your users would see, working	Until you clear site data
`launch.nordva.dev/grow/`, the questionnaire	Each answer is counted as it is chosen, the same way as any other goal on our own analytics, so a half-finished questionnaire is counted too. The email address you give at the end is required to see the plan, and your answers, and your site or project name if you give it, are kept with it on your contact in our own project. The tick box is separate and optional: it is the only thing that lets us email you later, and ticking it is recorded there with the time	Learn which kinds of reader arrive from which channel, show you your plan and send you one email with a link to it; anything after that only if you ticked the box	The counts 90 days; your email until you unsubscribe or ask us to delete it
`launch.nordva.dev/build-with-ai/pdf/`, the guide as a PDF	Your answers to four short questions (what you are building, how far along it is, how you are building it, when you want a paying user), your site or project name if you give it, and the email address you give to get the PDF, kept together on your contact in our own project and linked to your visit the same way as on /grow/, and that you ticked the required box agreeing to occasional email, with the time. Nothing is stored in your browser	Send you the PDF by email; put you on our own waitlist (it sends a receipt) for occasional email, each with an unsubscribe link	Your email until you unsubscribe or ask us to delete it
`launch.nordva.dev`, `nordva.dev`	Local storage: `nordva:surface`	Remember light or dark theme	Until you clear site data
`launch.nordva.dev` (`/launch-checklist/`)	Local storage: `nordva:launch-checklist`	Remember which steps of the launch checklist you ticked. Only the step names, nothing about you, and it never leaves your browser	Until you clear site data
`launch.nordva.dev` (the pages our ads link to, under `/get/` and `/…/short/`)	Local storage: `nordva:ab:<page>`, holding "a" or "b"	We test two versions of these pages. It remembers which one your browser was shown, so you see the same one when you come back. Nothing about you, and it never leaves your browser	Until you clear site data
`docs.nordva.dev`	Local storage: `starlight-theme`	Remember light or dark theme	Until you clear site data
Checkout and billing portal	Cookies set by Stripe on `stripe.com`	Payment, fraud prevention. These pages are hosted by Stripe, and Stripe’s cookie policy applies.	Set by Stripe

Forms that accept public submissions are protected by Cloudflare Turnstile, and all our sites are served through Cloudflare. Cloudflare may set a strictly necessary security cookie to tell people from bots. It is not used for advertising or analytics.

2. What we put on your site

If you are a customer, this is what our embeds store in your visitors’ browsers. You can copy it into your own cookie policy.

Embed	Cookies	Browser storage
Waitlist widget and hosted waitlist page	None	None. The signup’s source (referring site, UTM parameters, page path) is read once from the page and sent with the signup. When the analytics script is on the same page and may keep a visitor id, the widget asks it for that id and the visitor’s first touch and sends them with the signup instead; the widget itself reads no cookie and stores nothing.
Feedback widget	None	None
Feedback board (`launch.nordva.dev/board/…`, when the project switches it on)	None	Local storage on `launch.nordva.dev`: `nordva_board_voter`, a random id made from nothing about the person, sent with each vote so each idea counts one vote from this browser and it can be taken back. The votes are stored against it, and nothing else about the visitor.
Feedback board widget (`board.js`, on your site)	None	Local storage on your site, and only once the visitor votes: `nordva_board_client`, a random id made from nothing about the person, sent with each vote so each idea counts one vote from this browser. When your site signs a user id (`data-user-id` with `data-user-hash`), that user votes as themselves, the key is never written, and we keep only a one-way hash of the user id with the vote.
Changelog widget	None	Local storage, and only what the tag asks for. An inline list (the default, as before 2.0): `nordva_changelog_seen`, the id of the newest entry, once the visitor clicks the “New” badge, so the badge can clear; never sent to us. The launcher, sidebar, popup, modal and page modes also keep `nordva_changelog_opened`, when this browser last opened the widget, so it can count and mark the entries published since; with it, the widget tells us which entries were new to this browser (a count per entry, stored without anything that identifies the browser). Any mode with an announcement keeps `nordva_changelog_announced`, the ids of announcements already shown, so each is shown once. Only after the visitor reacts to an entry: `nordva_changelog_client`, a random id made from nothing about the person, sent with each reaction and stored with it, so a visitor reacts once per entry and can change it. When your site signs a user id (`data-user-id` with `data-user-hash`), read state and reactions are kept by us against that id and none of the last three keys is written.
Page views per source (only if you switch it on for the project and add `data-count-views` to a widget; hosted pages are counted server-side)	None	None. One request per landing carries the referring site’s hostname and the UTM values. We add it to a daily total per source and keep nothing else: no IP address, no user agent, no identifier. Moving between pages of the same site is not counted.
Notifications API	None	None. Your own code polls the API.
Analytics script (`e.nordva.dev/v1/s.js`)	Depends on your tracking mode and the visitor: see below. In `cookieless` mode only `nv_consent`, and only if your site calls `nordva('consent', …)`. None at all with `data-cookieless` on the tag	None, except `nordva:ignore` in a browser that asked not to be counted. None at all with `data-cookieless` on the tag

The analytics script’s cookies

You choose a tracking mode for your site in the dashboard. It decides when a visit may carry a visitor id:

auto (new sites): for visitors whose request comes from the EEA, the UK or Switzerland, no cookie until your site reports their consent with nordva('consent', true); for everyone else, the cookies below. If the country cannot be told, the visitor is treated as being in the EEA.
consent: no cookie for anyone until your site reports their consent.
cookies: the cookies below for everyone. For sites whose own consent tool loads the script only after the visitor agrees, or where no consent is needed.
cookieless: never an id, and none of the visitor cookies below. Visits are counted without recognising anyone.

The mode is kept on our server, so the script learns it from the answer to its first request. Until that answer, in every mode, it looks for its own cookies and for nordva:ignore and, unless the visitor already said no, sends a random id made in memory, which we do not store when the answer is no. With data-cookieless on the script tag it does none of that, from its first line: it stores nothing in the visitor’s browser and reads nothing stored there (no cookie, no local storage, no session storage), makes no visitor or session id, sends none, and does not ask our server whether one may be kept. nordva('consent', …) then does nothing, and ?nordva_ignore=1 leaves out only the page it is on. Cookies the script set under an earlier mode are not read, so they are not removed: they run out as the table says. The attribute can only make the script stricter than your mode.

In every mode, a browser that sends Global Privacy Control gets no id, and nordva('consent', false) removes the cookies and stores the refusal. The script sets nothing until our server has answered whether this visit may carry ids, and when the answer is no it deletes any it set earlier.

Cookie	What it holds	Why	How long
`nv_vid`	A random visitor id and the day it was made	Recognise a returning visitor, so visitors are counted once and a later signup or payment can be traced to the first visit	365 days from the visitor's last visit
`nv_sid`	A random session id and how many pages the session has seen	Tell one visit from the next (bounce rate, pages per visit)	30 minutes, renewed while the visitor is active
`nv_ft`	First touch: the referring site’s hostname, UTM values, `ref`, the first page, and a referral code from `?r=` when the link carried one	Remember where the visitor first came from, and who referred them	365 days from the last visit; its value is set once and never changed
`nv_consent`	`granted` or `denied`	Remember the visitor’s answer to a consent banner: yours, through `nordva('consent', …)`, or the script's own when the tag carries `data-banner`. Nothing is stored until they answer	180 days
`nv_t`	`1`	A test that finds which domain the cookies above can be set on	Removed at once
Local storage: `nordva:ignore`	`1`	Set only in a browser that opened a page of the site with `?nordva_ignore=1`, usually the site owner's own, so their visits are not counted: the script then sends nothing and stores nothing else	Until the browser opens `?nordva_ignore=0` or clears site data

All of them are first-party: set on your own domain, readable only by your site. One thing leaves in a link, never in a cookie: when a visitor who may carry an id clicks a link to your Lemon Squeezy checkout (*.lemonsqueezy.com/checkout/… or /buy/…), the script adds the visitor id to that link as checkout[custom][nv_vid], so a purchase can be traced to the visit that led to it. Lemon Squeezy returns it to us only if you set up the webhook for it. A visitor without an id gets an unchanged link. What the script sends, what we add and what we never store is listed in the Privacy Policy under “Web analytics events”. Whether you need your visitors’ consent, and in which countries, is for you to decide under the law that applies to your site; the modes above let you match it.

Whether the changelog widget’s storage needs consent on your site depends on the law that applies to you. The read state is used only for a feature the visitor sees, which is the kind of storage usually treated as strictly necessary; the reaction id exists only after the visitor reacts, and only to remember that reaction. If you would rather not rely on that, the public JSON feed lets you render the changelog yourself with no storage at all.

3. What we do not do

No retargeting and no ad personalisation. The one advertising tag is the Google Ads tag in section 1, on our marketing site and the billing return page only.
No third-party analytics except Cloudflare Web Analytics, which our host runs on nordva.dev, launch.nordva.dev and nettsider.nordva.dev (section 1); it sets no cookie and writes nothing to your browser. To learn which channels bring sign-ups, this site passes the ref and UTM values you arrived with along its own links, in the address bar, to the sign-up page. Nothing is stored in your browser on this site for it, and nothing is sent anywhere unless you sign up.
No following of people across sites. The analytics script’s ids are first-party, one set per site, random, and never combined between our customers or with anything outside the Service. Without the analytics script, nothing we provide recognises a visitor: attribution counts signups that pass through our forms, and page views per source (off unless you switch it on) are an anonymous daily count.
No fingerprinting across sites, and none without the visitor's permission. On a computer, where the analytics may keep ids, the first page of a visit also makes a keyed one-way code from the IP address, the browser string and the language, kept 30 days after it was last seen and different on every site, so a browser that cleared its cookies gets its old visitor id back instead of counting as someone new. Phones are never matched this way, and neither is a visitor who said no or sends Global Privacy Control.

4. Controlling cookies and storage

You can clear or block cookies and site data in your browser’s settings. Blocking the dashboard’s session cookies means you cannot stay signed in. Clearing local storage only resets the preferences above.

5. Changes and contact

If we ever add a cookie or storage entry, it will be listed here before it ships. A test in our code fails if the analytics script sets a cookie this page does not name. Questions: hello@nordva.dev. See also the Privacy Policy and the Data Processing Agreement.