Cookies and storage
Cookies and storage
What this site stores on your device, what it asks your consent for, what its host may set, and how to change your answer. It follows the ten points Datatilsynet sets out for cookies and consent, and it is kept true by the site's own build checks, described at the end.
What the banner asks
Norwegian law, section 3-15 of the Electronic Communications Act, says nothing may be stored on or read from your device without your consent unless it is strictly necessary to deliver what you asked for. This site asks for one thing that is not necessary: to count your visit.
With your consent, the page loads Cloudflare Web Analytics, a small script from Cloudflare that counts the visit for the publisher: the page you are on, the site that linked to it, your browser and operating system family, the country your connection comes from, and how quickly the page loaded. It sets no cookie and writes nothing to your browser, it does not try to recognise you on a later visit, and the publisher sees totals, never a person. Each report carries a random identifier for that one page load, so Cloudflare can match the measurements of one page view to each other; it is not stored on your device and connects one visit to no other. It reports tocloudflareinsights.com; Cloudflare processes it for the publisher under the agreement named on About this site, and may do so in its data centres in the United States under the transfer terms of its own privacy policy. Until you press Accept, nothing is loaded and nothing is counted. Press Reject and the page is exactly the same page without the count.
The basis for counting is your consent alone, under section 3-15 and GDPR Article 6(1)(a), given in the banner and taken back the same way; see "Consent, and taking it back" below.
What this site stores itself
One thing, and only after you have answered the banner: your answer.
| Name | Set by | What for | Lasts | Consent |
|---|---|---|---|---|
nexosa-consent | This site, in the browser's local storage | Your answer to the banner, yes or no, with the date you gave it, so the question is not put again on every page. | Counts for a year from the day you answered, for a yes and a no alike; visits do not restart the year, and a year is the publisher's choice of a reasonable period, not a legal requirement. The browser does not delete the entry by itself: after the year it is treated as no answer and removed the next time you open a page here, and sooner when you change it or clear the site's data. | Strictly necessary to honour the answer you gave; none needed. |
Nothing else. The pages set no cookie, write nothing to session storage or IndexedDB, and load nothing from anywhere but their own address and, after a yes, Cloudflare's statistics script; the fonts are served from here. The one address that is not a static file,/premium/link, exists only to link a device to Nexosa Premium, shows no banner and stores nothing in your browser. The answer lives in local storage rather than in a cookie because only the page needs it: a cookie would travel to the host with every request for no purpose. Either way it belongs to one browser on one device.
If your browser refuses to store anything, in a private window for instance, the banner says so: your answer applies to the page you are on and the question is put again on the next. A yes counts that one page; a no counts nothing. Nothing is presented as saved when it was not.
When the question changes, because a purpose is added or one changes, the answer's version number changes with it, an earlier answer is no longer read, and everybody is asked again. Nothing new is switched on under an old yes.
The host's cookies
The site is served by Cloudflare Pages, and Cloudflare can set cookies of its own, depending on how the publisher's Cloudflare account is configured. None of them is set by anything this site contains. Cloudflare's own cookie documentation calls each of them strictly necessary to provide the service its customer asked for, and asks its customers to disclose them. They are security measures that keep the site up under abuse, exempt from consent under section 3-15, and this is where they are declared, each with the setting that makes it appear.
| Name | Set by | What for | Lasts | Consent |
|---|---|---|---|---|
cf_clearance | Cloudflare | Stores the proof that your browser passed a challenge, so one is not issued again while it lasts. Set only after a challenge is passed, which Cloudflare's always-on protection can issue when a connection looks like an attack; most visitors never see one. It is marked Secure, SameSite=None and Partitioned, so it is kept for this site alone. | Until Cloudflare's challenge passage period ends, which the publisher sets; thirty minutes unless changed. | Strictly necessary; none needed. |
__cf_bm | Cloudflare | Tells automated traffic from people, so the site stays up when something hammers it. Set on every visit while Bot Fight Mode, Super Bot Fight Mode or Bot Management is on; all three are off for this site, so it is not set today. It holds an encrypted bot score that only Cloudflare can read, is made separately for each site, and corresponds to no identifier of yours. | Thirty minutes of inactivity. | Strictly necessary; none needed. |
cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m | Cloudflare | Cloudflare's own diagnostics for its challenge pages, so it can find faults in them. Set only while a challenge is being solved. | Cloudflare publishes no lifetime; clearing the browser's cookies removes them. | Strictly necessary; none needed. |
_cfuvid | Cloudflare | Tells apart visitors who share one address, such as a household behind one router, so a rate limit counts each of them rather than all of them together. Set only while a rate limiting rule that counts unique visitors is on; no such rule exists for this site, so it is not set today. | The browser session. | Strictly necessary; none needed. |
Which of them you receive follows from those settings, which the publisher keeps to what the site needs to stay up. None of them identifies you to the publisher or is used for anything but the security purpose named. Cloudflare's other cookies belong to products this site does not use: its load balancer (__cflb), sequence rules (__cfseq), Always Online (cf_ob_info and cf_use_ob), Waiting Room (__cfwaitingroom), the earlier rate limiting (__cfruid) and Cloudflare Access. They cannot appear here, and taking one of those products into use would mean updating this page first. Cloudflare describes each of them in its owncookie documentation, may process cookie data in its data centres in the United States under the transfer terms of its own privacy policy, and processes them for the publisher under the agreement named onAbout this site.
One more thing Cloudflare does while Bot Fight Mode is on: it inserts a small detection script of its own into each page, served from this site's own address under /cdn-cgi/challenge-platform/. Bot Fight Mode is off for this site. If it were turned on, that script would run, because the site's Content Security Policy allows scripts from the site's own address, and this page would say so first.
No cookie from anybody else can appear on this site: it loads nothing from any other host but Cloudflare's statistics script, that script sets none, and the build check below would fail if one did.
The apps
The desktop and phone apps are not browsers and use no cookies; what each keeps on a device, all of it strictly necessary and none of it read by the publisher, and how to clear it, is in section 6 of the privacy notice.
The browser client a server serves
A Nexosa server also serves a small client for a web browser, so a household can use it from a PC with nothing installed. It keeps your sign-in token in the browser's session storage, under the name nexosa.token, so you stay signed in while the tab is open; it is gone when the tab closes, and signing out removes it sooner. It sets no cookie and stores nothing else. That client is served by the server you signed in to, whose operator is the controller for it.
Consent, and taking it back
The banner is answered with one click either way, Reject or Accept, the two buttons the same size and the same colour, and "Customize" behind them shows each purpose with its own switch, off until you turn it on; there is one, and "Save selected" takes only what is on. Scrolling, waiting, reading on, pressing Close or pressing Escape stores nothing and counts nothing; the question simply returns on the next page. The page is not closed off behind the banner: everything on it works while the question stands, and the banner can be worked entirely from the keyboard.
Two controls sit in the Legal list at the bottom of every page. "Withdraw cookie consent" withdraws in one press: the refusal is saved, and if this page has already been counted, the page first refuses to send anything more to Cloudflare's collection address, including the last measurement a counting script sends as a page is left, and then reloads so that nothing further runs. "Cookie settings" opens the choices showing the answer in force, and Reject or Save selected records a new one the same way. A count already sent cannot be unsent: it sits in Cloudflare's totals for the site under the page-load identifier described above, which is tied to no cookie, account or later visit, so there is nothing there that names a person and Cloudflare offers no per-visitor deletion because none would apply. An answer given in one tab is taken up by the site's other open tabs, and a withdrawal in one stops the others sending too. Clearing this site's data in your browser removes the answer as well, and the question is put again on your next visit, as it is after a year in any case.
How this page stays true
Datatilsynet's tenth point is to keep your own house in order: know what is set, and by whom. The site's build opens every page in a real browser and fails if any response sets a cookie, or if a page leaves anything in local storage, session storage or IndexedDB before the banner is answered. Then it answers the banner every way there is, and fails unless Reject and Accept are the same size and the same colour, the switch starts off, scrolling, Close and Escape store nothing, Reject stores the one entry above and loads nothing, Accept stores it and loads Cloudflare's script once and nothing else, the footer's Cookie settings reopens the choices showing the answer given, Withdraw cookie consent saves the refusal, lets nothing more leave a counted page as it reloads, and the next page then loads nothing, a withdrawal in one tab silences another, a browser that refuses storage is told so and stores nothing, a year-old answer brings the question back and its record is removed, and every control works from the keyboard and on a short phone screen. The check never fetches Cloudflare's own script, so it counts no visit; a stand-in that sends on loading and again on leaving the page, as the real one does, answers its address, and every send is counted.
The site's Content Security Policy, the rule the browser enforces on every page, allows the site's own script and Cloudflare's statistics script, and lets the page report to Cloudflare's collection address and nowhere else. Nothing from any other host can load, and no inline script can run. A host can also add scripts of its own at the edge, after the build, for analytics, email obfuscation, Rocket Loader or Zaraz, which no build check can see; they are switched off for this site, and the publisher's Cloudflare settings are reviewed together with this page.
Last reviewed 18 September 2026. The full inventory, with the evidence behind each line, is kept with the site's source as docs/cookie-inventory.md. The guidance this page follows is Datatilsynet'suse of cookies and other tracking technologies.