Privacy on your site

What the script collects

• The page's address, without its query string, except the utm tags.
• The site the visitor came from, never the page.
• The country, region and city, from Cloudflare.
• Whether the device is a phone, a tablet or a computer, and the names of the browser and the operating system, from what the browser says it is, never the rest of what it says.
• Taps on your phone number, email address and map links.
• Clicks on links to other sites and to files, pages your site answered as not found, and the names of any events you set up.
• How visitors use your own forms, never what they type (below).

A visitor is counted with a key made from that day's random salt, the IP address, the browser and your site. The salt is deleted after its day, so the key can't be traced back or linked to another day, and the IP address is never stored.

No cookies, and the banner question

The script sets no cookies and stores nothing on the visitor's device: no local storage, no session storage. A browser that sends Do Not Track or Global Privacy Control isn't counted at all.

Whether counting without cookies still needs consent where you are is a legal question for you and your adviser, and the answer differs between countries. Nodium can't decide it for you.

Your own forms

The script notices which field of one of your own forms someone went into, whether it was empty when they pressed Send, whether your form marked it wrong, and whether the form was sent. It never reads what anyone types, and it skips password, hidden, payment and file fields. What the script reads has it field by field.

A sentence for your privacy notice

Your own privacy notice should say you use Nodium. You're welcome to use or adapt this:

We count visits to this site with Nodium (usenodium.com), which sets no cookies and stores nothing on your device. It counts a visitor with a key made from your IP address and browser that changes every day and can't be traced back to you, and it never stores your IP address. On our forms it notes which fields are filled in and whether the form was sent, never what you type.

Who's responsible for what

You decide what your site collects and why, so you're the controller. Nodium is the processor: it processes your visitors' data only to give you Nodium, under the Data Processing Addendum. The Privacy Policy covers what Nodium does with its own customers' data, and Data and deletion how long everything is kept.