Cookies

On your website: cookie and cookieless mode

Each site chooses a tracking mode in its settings. The install snippet changes to match.

Cookie mode

Our script sets two first-party cookies on your domain. They are never shared across other websites.

Name	Purpose	Lifetime
nbs_vid	A random visitor id, so returning visits and later payments can be linked to the visit that started them.	1 year
nbs_sid	A random session id that groups one visit's pageviews.	30 minutes, renewed on each event

Cookie mode gives the most accurate visitor counts and attribution over weeks and months — useful when people visit several times before they buy.

Cookieless mode

The script sets no cookies. It keeps a random session id in the tab's sessionStorage, which is removed when the tab is closed, and the server counts visitors with a hash of the site, IP address and user agent salted with a value that is replaced and deleted daily. No raw IP address is stored. A returning visitor is counted again on each new day, and payments are linked to the visit they happened in.

Do I need a consent banner?

In the UK (PECR) and the EU (the ePrivacy Directive and national laws based on it), storing or reading information on a visitor's device generally needs consent unless it is strictly necessary for a service the visitor asked for. Analytics cookies are usually not treated as strictly necessary, so cookie mode is likely to need consent in the UK and EU. Some regulators have signalled a more relaxed approach to low-risk, first-party analytics, but the rules differ by country and are changing.

Cookieless mode is designed so that no persistent identifier is stored on the device, which in many cases means no consent banner is needed. The per-tab session id in sessionStorage is short-lived and used only to group a visit's pageviews; whether it needs consent can depend on how your regulator reads the rules.

This page is general information, not legal advice. Your obligations depend on where your business and visitors are and on everything else your site does, so please get your own advice. Whatever mode you choose, mention your analytics in your privacy notice.

If you use a consent tool, a common approach is to load the script with data-cookieless by default and load it without that attribute for visitors who accept. Keep the site itself in cookie mode: visitors whose script runs cookieless are then counted the cookieless way, and everyone else with cookies.

On our own website and app

Our marketing pages are measured with nbsanalytics in cookieless mode, so they set no analytics cookies. We use no advertising or third-party tracking cookies. When you sign in we use:

Name	Type	Purpose	Lifetime
_nbs_key	Cookie, strictly necessary	Keeps you signed in and protects forms against cross-site request forgery.	Until you close the browser
_nbs_web_user_remember_me	Cookie, strictly necessary	Keeps you signed in between browser sessions, only if you choose to stay signed in.	14 days
phx:theme	Local storage, preference	Remembers whether you chose the light or dark theme.	Until you change it

Because these are strictly necessary or remember a choice you made, we don't ask for consent for them. You can delete them in your browser settings; you'll then be signed out.

Questions

Email [CONTACT EMAIL].