Cookie policy

Introduction

When you visit Nordvec's website and web application, information is collected using cookies and similar technologies. This policy explains which cookies we use, why, and how you can manage them.

What are cookies?

Cookies are small text files a website stores on your device. Nordvec uses them to keep you signed in and to remember your settings.

Necessary cookies

These cookies are required for the platform to function and cannot be deactivated: __Host-sb-*-auth-token (Supabase Auth session token; written for up to 400 days, the authentication library's fixed lifetime, while the signed-in session inside it expires on the server's schedule and is removed when you sign out), __Host-sb-*-auth-token-code-verifier (PKCE code verifier for the sign-in flow, removed as soon as the sign-in completes), NEXT_LOCALE (language preference, 365 days), NEXT_TIMEZONE (the time zone dates are shown in, 30 days, renewed on each visit), sidebar_state (whether the application sidebar is open, 7 days), oauth_state_* (a single-use, HttpOnly state token while you connect a source, one per source, 10 minutes), and three __Host-nordvec-console cookies set only for Nordvec staff who sign in to the operations console (a signed session of 8 hours and two single-use passkey ceremony tokens of 5 minutes). The application also keeps interface state such as open panels, unsent drafts and your theme in your browser's local storage, after a sign-in the name of the sign-in method you used (Google, Microsoft or password, so the sign-in page can point to it next time, forgotten when you sign out), and the bookkeeping that lets an interrupted upload resume in the browser's IndexedDB; none of it leaves your browser or is used to recognise you across sites.

Analytics and marketing cookies: none

Nordvec sets no analytics or marketing cookie, on the website or in the application, and loads no script that would. The application's Content-Security-Policy lets the browser send data only to Nordvec's own origin and its database host, and a test pins that list, so adding a tracker needs a reviewed change. If we ever add an EU-hosted analytics tool, it will be listed here first, off until you turn it on, and a consent banner will come with it.

Third-party cookies

Error tracking: the browser sends error reports to our own servers, never to a third party, so no error-tracking cookies are set. No session replay and no page content is recorded. Payment provider: when billing is enabled via Mollie, it may set its own cookies on payment pages.

Consent

Every cookie listed above is strictly necessary to provide the service you asked for, which is the one case where Article 5(3) of the ePrivacy Directive requires no consent. That is why there is no cookie banner: a banner asking consent for categories that do not exist would ask you to decide nothing, and the choice it stored would itself be the only non-essential thing written to your device. We keep no consent record either, because there is no consent to record. You control the necessary cookies through your browser.

Deleting cookies

You can always delete cookies via your browser settings (Chrome/Edge/Firefox: Ctrl + Shift + Delete, Safari: Settings > Privacy > Manage Website Data). Note that deleting necessary cookies will log you out of the platform.

Contact regarding cookies

If you have questions regarding our use of cookies, please contact us at privacy@nordvec.com.