Cookie Policy

1. Introduction & Scope

This Cookie Policy provides comprehensive information about the use of cookies and similar technologies in connection with the use of Noralytic – the privacy-friendly web analytics platform from NoraMedia.

This policy applies to:

• The Noralytic platform itself (noralytic.com, dashboard, API)
• The tracking code that our customers integrate on their websites

Noralytic is specifically designed to work entirely without tracking cookies, IP storage or user sessions on analysed websites.

2. What Are Cookies?

Cookies are small text files that are stored on your device (computer, smartphone, tablet) when you visit a website. They allow websites to store information about your visit and recognise you on later visits.

2.1 Types of Cookies

There are different types of cookies:

By storage period:

• Session cookies: Are deleted automatically when you close the browser
• Persistent cookies: Remain stored on your device for a defined period

By provider:

• First-party cookies: Are set by the visited website itself
• Third-party cookies: Are set by external services (e.g. advertising networks, analytics)

By purpose:

• Strictly necessary cookies: Required for basic functions (e.g. login, shopping cart)
• Functional cookies: Enable enhanced functions (e.g. language settings)
• Analytical cookies: For collecting usage statistics
• Marketing cookies: For displaying personalised advertising

3. Use of Cookies on noralytic.com

On our own website (noralytic.com) and in the dashboard, we use only strictly necessary cookies that are required for the operation of the platform.

3.1 Strictly Necessary Cookies (First-Party)

Cookie name	Purpose	Type	Storage period
noralytic_session	Maintaining the login session after signing in	Session	30 days or until logout
csrf_token	Protection against cross-site request forgery attacks	Session	Until the browser is closed
noralytic_lang	Storing the selected language	Persistent	12 months
noralytic_timezone	Storing the time zone preference	Persistent	12 months

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a functioning website)

Consent required: No – these cookies are strictly necessary

3.2 What We Do NOT Use

On noralytic.com we explicitly do NOT use:

• ❌ Third-party analytics cookies (Google Analytics, Matomo, etc.)
• ❌ Marketing or advertising cookies
• ❌ Social media plugins with tracking (Facebook Pixel, LinkedIn Insight Tag, etc.)
• ❌ Third-party tracking pixels or web beacons
• ❌ Retargeting or remarketing cookies
• ❌ Affiliate tracking cookies

Result: You can use noralytic.com without a cookie banner or consent requirement.

4. Tracking Code on Customer Websites – NO Cookies

The real core of Noralytic: the tracking code that our customers integrate on their websites.

4.1 Does the Noralytic Tracking Code Use Cookies?

No – absolutely no cookies!

Technically, the Noralytic tracking code sets:

• ✓ No cookies (neither first-party nor third-party)
• ✓ No LocalStorage or SessionStorage
• ✓ No IndexedDB entries
• ✓ No service workers with data collection
• ✓ No browser fingerprints (canvas, WebGL, audio, font fingerprinting)
• ✓ No IP addresses stored
• ✓ No session IDs or user IDs
• ✓ No cross-site tracking

4.2 How Does Noralytic Work Without Cookies?

Noralytic uses an innovative approach:

1. Event-based collection: Each pageview is recorded as a single, independent event
2. Real-time aggregation: Data is aggregated immediately on the server side
3. No assignment to individuals: Individual pageviews are not linked to a user profile
4. Stateless tracking: Each request is stateless and independent

Technical detail: The tracking code sends HTTP POST requests to our servers with aggregated metadata (URL, referrer, user agent in generalised form), without transmitting or storing identifiers.

4.3 What Is Collected?

The following anonymised, non-personal data is collected for web analytics:

• Pageview: URL and page title
• Timestamp: Date and time (without user assignment)
• Referrer: Where the visitor came from (e.g. search engine, social media)
• User agent (generalised): Browser family, operating system category, device type
• Geographic data (aggregated): Country and city (without IP storage)
• Screen resolution: Device category (desktop, tablet, mobile)
• Custom events: Events defined by the website operator (e.g. button clicks)

Important: All data is aggregated immediately and cannot be assigned to an individual person.

5. Legal Classification & Compliance

5.1 Why Is No Cookie Consent Necessary?

Under the following legal bases, no consent is required:

GDPR (EU General Data Protection Regulation)

• No personal data within the meaning of Art. 4 No. 1 GDPR is processed
• No IP addresses, no unique identifiers, no link to individuals
• Result: GDPR is not applicable to Noralytic tracking

ePrivacy Directive (Cookie Directive 2009/136/EC)

• Art. 5 (3) ePrivacy Directive requires consent for the storing or accessing of information on the terminal device
• Noralytic stores no information on the user's device
• Result: No consent requirement under ePrivacy

PECR (UK Privacy and Electronic Communications Regulations)

• Regulation 6 PECR applies analogously to the ePrivacy Directive
• Result: No consent required in the UK

TDDDG (German Telecommunications Digital Services Data Protection Act)

• Section 25 TDDDG regulates the storage of and access to terminal devices
• Noralytic does not store any information on terminal devices
• Result: Section 25 TDDDG is not applicable

CCPA (California Consumer Privacy Act)

• The CCPA protects the "personal information" of California consumers
• Noralytic does not process "personal information"
• Result: CCPA compliant without an opt-out obligation

5.2 Summary: No Cookie Banner Needed

Websites that use only Noralytic do NOT need a cookie banner or consent management tool for analytics tracking.

This applies only to Noralytic itself. Other tools (Google Analytics, Facebook Pixel, etc.) have their own requirements.

6. Comparison with Other Analytics Tools

For better context, here is a comparison:

Feature	Noralytic	Google Analytics (GA4)	Matomo (with cookies)
Cookies set	✓ None	✗ Yes (_ga, _gid, etc.)	✗ Yes (_pk_id, etc.)
IP addresses stored	✓ No	~ Anonymisation possible	~ Anonymisation possible
User tracking across sessions	✓ No	✗ Yes	✗ Yes
Consent required	✓ No	✗ Yes (GDPR/ePrivacy)	~ Yes (with cookies)
Data transfer to the USA	✓ No (EU servers)	✗ Yes (Google servers)	✓ Optional (self-hosted)
GDPR compliant without adjustments	✓ Yes	✗ No	~ With configuration

7. Third-Party Cookies on Customer Websites

Important note: Even though Noralytic itself does not set any cookies, other services on the customer's website may use cookies.

7.1 Common Third-Party Cookies

Examples of services that set their own cookies:

Analytics & Tracking

• Google Analytics: _ga, _gid, _gat
• Facebook Pixel: _fbp, fr
• Hotjar: _hjid, _hjIncludedInSessionSample
• LinkedIn Insight Tag: li_sugr, lidc

Marketing & Advertising

• Google Ads: IDE, DSID, test_cookie
• Criteo: uid, uic
• DoubleClick: IDE

Social Media

• Facebook: datr, sb, c_user (with like buttons, share buttons)
• YouTube: VISITOR_INFO1_LIVE, YSC (with embedded videos)
• Twitter: personalization_id, guest_id

Functional Services

• Google Maps: NID, CONSENT
• reCAPTCHA: _GRECAPTCHA
• Stripe: __stripe_mid, __stripe_sid (payment processing)

7.2 Responsibility Lies with the Website Operator

The website operator is responsible for these third-party cookies. The respective cookie and privacy policies of the integrated providers apply.

What does this mean?

• The website operator must list these cookies in their own privacy policy
• When tracking cookies are used, a cookie banner is generally required
• Consent must be obtained (opt-in obligation)
• Consent management platforms (CMPs) should be used

8. Responsibility of the User (Website Operator)

As a Noralytic customer and website operator, you are responsible for:

8.1 Lawful Integration

• Correct integration of the Noralytic tracking code
• No manipulation or alteration of the code
• Compliance with the Terms of Service

8.2 Privacy Policy

• Mentioning Noralytic in your privacy policy
• Pointing out the privacy-friendly nature (no cookies, no IP storage)
• Link to this Cookie Policy (optional but recommended)

Sample text for your privacy policy:

Web analytics with Noralytic

This website uses Noralytic, a privacy-friendly web analytics service. Noralytic works without cookies, without IP storage and without user tracking. Only anonymised, aggregated statistics are collected, which do not allow conclusions to be drawn about individual persons.

No consent is required, as no personal data within the meaning of the GDPR is processed.

Provider: NoraMedia, Leipziger Str. 38, 36037 Fulda
More information: Noralytic Cookie Policy

8.3 Other Tracking Tools

• Documentation of all tracking and analytics services used
• Obtaining required consents for cookie-based tools
• Implementing a cookie banner if other services set cookies
• Regular review of the cookie list (cookie audit)

8.4 Recommended Measures

We recommend that website operators:

1. Use a cookie scanner: Tools such as CookieMetrix, OneTrust or Cookiebot to identify all cookies
2. Principle of minimisation: Only use tracking tools that are really needed
3. Consent management: Use a professional CMP when using cookies
4. Regular audits: Quarterly review of the technologies used
5. Legal advice: If in doubt, consult a data protection expert

9. LocalStorage & Other Technologies

In addition to cookies, there are other storage technologies in the browser:

9.1 What Noralytic Does NOT Use

• LocalStorage: Persistent key-value pairs in the browser
• SessionStorage: Temporary storage for a browser session
• IndexedDB: Local database in the browser
• Web SQL: Deprecated SQL database in the browser
• Cache Storage: Caching mechanism for service workers
• Application Cache: Deprecated offline storage
• Flash cookies (LSOs): Supercookies in Flash technology
• ETags: HTTP header as a tracking mechanism

The Noralytic tracking code stores NOTHING locally on the visitor's device.

9.2 Browser Fingerprinting

Fingerprinting is a technique for recognising users by unique device/browser characteristics:

• Canvas fingerprinting (rendering differences)
• WebGL fingerprinting (graphics card)
• Audio fingerprinting (sound card)
• Font fingerprinting (installed fonts)
• Battery API, WebRTC leak, etc.

Noralytic does NOT use fingerprinting techniques. The user agent is only recorded in generalised form (e.g. "Chrome Desktop Windows" instead of exact versions and configurations).

10. Cookie Management in the Browser

Even though Noralytic does not set any cookies, you can generally manage the cookie settings in your browser:

10.1 Google Chrome

1. Settings → Privacy and security → Cookies and other site data
2. Options: Allow all cookies, block third-party cookies, block all cookies
3. Site-specific settings under "See all cookies and site data"

10.2 Mozilla Firefox

1. Settings → Privacy & Security → Cookies and Site Data
2. Standard: "Enhanced Tracking Protection"
3. Strict: Blocks third-party cookies and tracking content

10.3 Safari (macOS/iOS)

1. Safari → Settings → Privacy
2. Intelligent Tracking Prevention (ITP) is enabled by default
3. Option: "Block all cookies" for maximum protection

10.4 Microsoft Edge

1. Settings → Privacy, search and services
2. Tracking prevention: Basic, Balanced (default), Strict
3. Manage cookies and site data

Note: Blocking all cookies may impair the functionality of some websites (e.g. login areas).

11. Transparency & Traceability

11.1 How You Can Verify That Noralytic Does Not Set Cookies

You can verify for yourself that Noralytic works cookie-free:

Method 1: Browser developer tools

1. Open a website with Noralytic tracking
2. Press F12 (Chrome/Firefox) to open the developer tools
3. Go to "Application" (Chrome) or "Storage" (Firefox)
4. Check "Cookies" → No cookies from Noralytic should appear
5. Check "Local Storage" and "Session Storage" → No Noralytic entries

Method 2: Browser extensions

Use cookie analysis tools such as:

• EditThisCookie (Chrome)
• Cookie-Editor (Firefox/Chrome)
• Ghostery (multi-browser) – shows tracking technologies

These tools transparently show which cookies and trackers are active on a website.

11.2 Network Analysis

Look at the network requests:

1. Developer tools (F12) → Network
2. Reload the website
3. Look for requests to Noralytic servers
4. Check the request headers: No cookie headers sent
5. Check the response headers: No Set-Cookie headers received

12. Frequently Asked Questions (FAQ)

Do I need a cookie banner for Noralytic?

No. If you use only Noralytic, no cookie banner is required, as no cookies are set and no personal data is processed.

Do I have to mention Noralytic in my privacy policy?

Yes, recommended. Even though there is no consent requirement, for reasons of transparency you should mention that you carry out web analytics with Noralytic. Use our sample text (see Section 8.2).

Can I combine Noralytic with Google Analytics?

Yes, technically possible. However, you would then need a cookie banner and consents for Google Analytics, as Google Analytics sets cookies and processes personal data.

Is Noralytic really 100% GDPR compliant?

Yes. Noralytic does not process personal data within the meaning of the GDPR. No IP addresses are stored, no cookies are set and no user profiles are created. The GDPR is therefore not applicable to Noralytic tracking.

What happens if I use Noralytic on an EU website with US visitors?

No problem. Since no personal data is processed, the location of the visitors does not matter. Noralytic is both GDPR and CCPA compliant.

Can I still voluntarily use a cookie banner?

Yes, you can. Some website operators still want to inform for reasons of transparency. You can use a purely informative notice (without an opt-in obligation for Noralytic).

13. Best Practices for Website Operators

13.1 Recommended Cookie Strategy

This is how you make your website privacy-friendly:

1. Analyse: Create a list of all tools used and their cookie usage
2. Minimise: Reduce cookie-based tools to what is necessary
3. Replace: Swap Google Analytics for Noralytic
4. Document: Keep a directory of all cookies (cookie policy)
5. Optimise: Only set strictly necessary cookies without consent
6. Transparency: Inform transparently in your privacy policy

13.2 Ideal Setup for Privacy-Friendly Analytics

Option 1: Noralytic only (optimal)

• ✓ No cookie banner necessary
• ✓ No consents required
• ✓ Full analytics data without data loss
• ✓ Faster loading times (no CMP script)
• ✓ Better user experience (no disruptive banner)

Option 2: Noralytic + functional cookies

• Noralytic for analytics (no banner needed)
• Functional cookies for features (e.g. shopping cart, login)
• Informative notice (optional, without opt-in obligation)

Option 3: Noralytic + marketing tools (banner required)

• Noralytic always runs (no opt-in needed)
• Marketing cookies (Google Ads, Facebook) only after consent
• Implement a cookie banner for marketing tools
• Use a CMP (consent management platform)

14. Changes to this Cookie Policy

We reserve the right to adapt this Cookie Policy as required, in particular in the event of:

• Changes in the legal situation (new laws, court rulings)
• Further development of our technology
• New features or services
• Changes in cookie usage on noralytic.com

Material changes will be published on this page and, where applicable, communicated to registered users by email.

The current version is always available at www.noralytic.com/cookie-richtlinien.

15. Contact & Further Information

If you have questions about this Cookie Policy or the use of cookies, please contact us:

NoraMedia – Cookie Policy
Leipziger Str. 38
36037, Fulda
Support: help@noralytic.com
Website: www.noralytic.com

15.1 Further Resources

• Privacy Policy
• Terms of Service

15.2 External Resources

• GDPR legal text (EU)
• Federal Commissioner for Data Protection (BfDI)
• CCPA information (California)

Version 2.0