Cookie policy

ngguide sets one cookie, and only after you sign in. It keeps you signed in. There is no analytics cookie, no advertising cookie, no third-party tracker on any page of this site.

We do measure traffic, with our own cookieless counter running on our own servers. Section 03 is what that means and why it does not change the answer here.

That is why you have not seen a consent banner. Under the ePrivacy rules — art. 5(3) of Directive 2002/58/EC, in Spain art. 22.2 LSSI — consent is needed to store or read anything on your device that is not strictly necessary for a service you asked for. A session cookie for a service you signed into is exempt, and analytics that writes nothing to your device never engages the rule at all. When something non-essential shows up, the banner shows up with it.

That is the complete list. If a page ever sets something else, this table is wrong and we want to hear about it at igor@ng.guide.

We count visits, so we know which pages are worth writing more of. The counter is our own — it runs on our servers and the counts live in our own database — and it works without cookies: nothing is written to your browser and nothing is read back from it. Visitors are distinguished by a hash we derive on our side from the incoming request, salted with a value that changes every day — the hash is built to expire, and we do not tie it to accounts or follow it from one day to the next. That is why art. 5(3) — the rule that makes banners necessary — never applies.

What it records for each pageview:

• The page url, the domain the visit came from, campaign tags, and rough location down to country. Not your IP address and not your browser details — both go into the daily hash and are then discarded.
• Nothing tied to your account. The counter does not know you are signed in, and we send no custom events, so nothing can carry a user id.
• Urls are redacted before they leave your browser, and redacted again on the server before anything is stored: the Stripe session id on the checkout return page is stripped, admin pages and invitation links are dropped outright, and every query parameter except campaign tags (utm_*, ref) is removed. That last one is an allowlist — a parameter nobody thought about gets dropped, not sent.

Search crawlers and AI agents are counted too — from the user agent they declare, in rows of their own that carry the crawler’s name (googlebot, gptbot, claudebot) instead of a visitor hash. A bot is not a person, and nothing in those rows relates to one.

The legal basis is legitimate interest (art. 6(1)(f)): we want to know what people read, the data is aggregated and does not identify anyone, and you can object at igor@ng.guide.

• No Google Analytics, Tag Manager, Meta pixel, LinkedIn or TikTok tag.
• No session recorder, heatmap, or A/B tool.
• No advertising or cross-site identifiers of any kind. There is no ad product here to feed.
• No embedded YouTube, Vimeo, or social widget that would set cookies on our pages.
• No custom analytics events, which is what keeps the measurement above genuinely anonymous.

This is verifiable rather than promised: the site loads no script from another host at all — the analytics above is part of the site itself — and the dependency list is the evidence.

Two flows send you to somebody else’s domain, where their rules apply, not ours:

• Checkout. Paying takes you to Stripe’s own hosted page. Stripe sets its own cookies there, including ones for fraud prevention, under their privacy policy. We do not embed Stripe scripts on ng.guide.
• Sign-in. Choosing Google or GitHub hands you to their login page, which uses their cookies. You come back with a session; we never see their cookies.

Every browser lets you block or delete cookies, and clearing site data for ng.guide removes both entries in section 02. Analytics has nothing on your device to clear; if you would rather not be counted at all, a content blocker stops the beacon request, and the site works exactly the same without it.

Blocking the session cookie means you cannot stay signed in, which means no dashboard and no licence — that is a functional consequence, not a penalty.

Anything that stores on your device, identifies you, or reaches another host — a tracker, an embed, custom analytics events — needs a consent mechanism in front of it and a rewrite of this page, before it ships. The rest of the picture is in the privacy policy.