Arcnorm — Cookie Policy

This Cookie Policy explains the cookies and similar storage (including local storage) that Arcnorm uses, why we use them, and how you can control them. It supplements our Privacy Policy, which describes the personal data we process and your rights.

We group what we use into three states: strictly necessary storage, which the Service needs in order to work; anonymous counting, which runs until you make a choice and stores nothing on your device; and optional analytics, which runs only if you accept it.

Where you are visiting from determines how consent is asked for. If you are in the European Economic Area, the United Kingdom, or Switzerland, optional analytics is switched off until you actively agree. If you are elsewhere, optional analytics is on by default and you can switch it off. When we cannot determine your country we default to asking for consent first, because that is the safer choice. In every region, until you answer, only anonymous counting runs (section 4): it sets no cookie, writes nothing to your device, keeps no identifier there, and cannot be linked to you. Accepting turns the optional analytics on; rejecting stops the anonymous counting too.

Your choice is stored in a first-party consent cookie (arcnorm_consent) together with a consent identifier and the version of this policy that applied. The arcnorm_consent cookie is kept for 365 days when all categories are accepted, or 182 days (approx. 6 months) when custom or strictly necessary preferences are chosen. A server-side proof of your consent decision is recorded for up to 24 months to satisfy the accountability requirement of Regulation (EU) 2016/679 (GDPR) Art. 7(1). A material change to this policy invalidates the stored consent and asks for your choice again.

These are required for the Service to function, to keep it secure, and to bill for it correctly. They are not used for analytics or advertising, and they cannot be switched off.

• Sign-in and session management — set by our identity provider, Clerk (__session, __client_uat, and related session cookies), so that you stay signed in and your session is secure.
• Security, rate limiting and conversation state — local storage keys arcnorm.device-id and arcnorm.conversation-id:* used to keep a conversation's identifier and to prevent automated abuse (the anonymous allowance they formerly enforced is retired; the free allowance is now part of your account).
• Billing — cookies and storage set or read during checkout and subscription management through our payment processor, Stripe.
• Error monitoring — Sentry error and crash reporting so that faults are found and fixed. Session replay and performance tracing are not part of this and require consent.
• Consent record — the arcnorm_consent cookie (stored for 182 to 365 days) that records your choice, and local storage preferences (such as interface language) that keep the Service usable. Interface icons (the Font Awesome font) are loaded from cdnjs, a Cloudflare content-delivery service, so your browser requests them from Cloudflare; that request carries your IP address, sets no cookies, and is not used for analytics.
• Interface language — the arcnorm_ui_locale cookie (stored for 365 days) remembers the language you chose, so the pages you open are already rendered in it instead of switching language after they load. It is written only when you choose a language, it carries no identifier of any kind, and it is not used for analytics.

These run only when the analytics category is accepted. Refusing or withdrawing them does not affect your access to the Service, and no feature is conditioned on accepting them. The analytics category also includes product-interaction events, such as starter-question clicks and result expansion, within the same measurement. The last item in this section describes the separate anonymous counting that runs before you answer.

• PostHog (product analytics, EU region) — how the Service is used once you have accepted: pages viewed, chat events, ratings, and share views, keyed to persistent browser identifiers (ph_*_posthog cookies and local storage). Both the identifiers and the analytics state are cleared when you withdraw consent.
• Google Analytics 4 — aggregate measurement of visits and interactions (_ga, _gid cookies). We use Google Consent Mode v2 with analytics storage denied until you consent; the advertising signals (ad_storage, ad_user_data, ad_personalization) remain denied because Arcnorm runs no advertising. Cookies are cleared automatically if you withdraw consent.
• Sentry Session Replay and performance tracing — sampled in-memory and DOM recording and timing data used to reproduce and fix problems, running only in the browser session while consent is active.

Anonymous counting before you choose. Until you accept or reject, PostHog runs in its cookieless mode: each event is sent without a cookie, without local storage and without any identifier stored on your device, and carries only coarse facts — the page path, the interface language, a referrer reduced to its host, and the kind of interaction (which of the surfaces above was opened or followed). Free text, conversation and share identifiers, device and environment details, and every campaign or ad-click parameter are dropped before the event leaves the browser, and feature flags and session recording are switched off entirely. The request still carries your IP address and user agent, which PostHog hashes for that event so that two visits can be told apart without either being identified; we store no identifier on your device and do not link this counting to you or to any account. Because it sets and reads nothing on your device, we do not rely on your consent for it: we rely on our legitimate interest in measuring and improving the Service (Art. 6(1)(f)). Choosing Reject analytics stops it completely, and that is also how you object (Art. 21).

Analytics data is processed by the providers named above under our instructions. PostHog is configured for EU data residency. Where a provider processes data outside the European Economic Area, we rely on the transfer safeguards of Chapter V of the GDPR (Art. 44), such as the European Commission's Standard Contractual Clauses (Art. 46(2)(c)). No analytics data is sold. Static interface assets (the icon font) are delivered by Cloudflare's cdnjs content-delivery network.

You can change or withdraw your consent at any time with the Cookie settings control, available in the footer of every page and on this page. Withdrawing consent stops the optional analytics immediately, clears the cookies and local storage they set, and reloads the page once so that nothing the withdrawn consent allowed is left running; strictly necessary storage continues, because the Service cannot operate without it.

You can also control cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary storage may prevent you from signing in or using parts of the Service.

We rely on your consent (Art. 6(1)(a)) for optional analytics, which you may withdraw at any time (Art. 7(3)). For the anonymous counting that runs before you choose (section 4) we rely on our legitimate interest in measuring and improving the Service (Art. 6(1)(f)): it stores nothing on your device, keeps no identifier, and cannot be linked to you, and rejecting analytics stops it — which is also how you object (Art. 21). For strictly necessary processing we rely on the performance of our contract with you, our legal obligations, and our legitimate interest in operating a secure and reliable service.

You have the rights described in our Privacy Policy, including the right to withdraw consent at any time (Art. 7(3)) and the right to lodge a complaint with a supervisory authority (Art. 77). To exercise them, contact us at legal@arcnorm.com.

We may update this Cookie Policy when the cookies or services we use change. When that happens we update the version recorded with your consent, which means you will be asked to make your choice again.