**Version:** 1.0 (DRAFT) **Effective date:** May 15, 2026 **Last updated:** April 14, 2026
> **DRAFT NOTICE:** This document is a template pending review by outside legal counsel. Do not treat it as final legal advice.
---
1. What Are Cookies
Cookies are small text files stored on your device when you visit a website. They serve various purposes: keeping you logged in, remembering your preferences, and helping us understand how people use our site.
We also use `localStorage` for client-side preference storage. Where relevant, we treat localStorage entries the same as cookies for consent purposes.
---
2. Cookie Categories
We organize cookies into three categories:
### Necessary (always active)
These cookies are required for the site to function. They cannot be disabled.
### Analytics (opt-in)
These cookies help us understand how visitors use our site. They are only set after you consent.
### Marketing (not currently used)
We do not currently use any marketing or advertising cookies. If we add them in the future, they will require your explicit consent before being set.
---
3. Cookie Audit Table
The following table lists every cookie and storage entry used across nself.org and its subdomains. This table is regenerated periodically from an automated audit.
| Cookie / Storage Key | Set By | Category | Purpose | Duration | Domain | |---------------------|--------|----------|---------|----------|--------| | `next-auth.session-token` | nSelf (NextAuth) | Necessary | Authentication session for logged-in users | 30 days | cloud.nself.org, task.nself.org | | `next-auth.csrf-token` | nSelf (NextAuth) | Necessary | CSRF protection for authentication flows | Session | cloud.nself.org, task.nself.org | | `next-auth.callback-url` | nSelf (NextAuth) | Necessary | Stores redirect URL during auth flow | Session | cloud.nself.org, task.nself.org | | `nself_consent` | nSelf | Necessary | Records your cookie consent preferences | 1 year | *.nself.org | | `_stripe_sid` | Stripe | Necessary | Fraud detection during checkout | Session | cloud.nself.org | | `_stripe_mid` | Stripe | Necessary | Fraud detection (device fingerprint) | 1 year | cloud.nself.org | | `_ga` | Google Analytics | Analytics | Distinguishes unique visitors | 2 years | *.nself.org | | `_ga_*` | Google Analytics | Analytics | Maintains session state for GA4 | 2 years | *.nself.org | | `plausible_ignore` | Plausible | Analytics | Self-hosted analytics opt-out flag | Persistent | *.nself.org |
### localStorage Entries
| Key | Category | Purpose | Set when | |-----|----------|---------|----------| | `nself_consent` | Necessary | Mirror of cookie consent state (version, categories, timestamp) | On consent decision | | `theme` | Necessary | Dark/light mode preference | On theme toggle |
---
4. How to Manage Your Preferences
### Cookie banner
On your first visit, a cookie banner appears at the bottom of the page with three options:
- **Accept all** — enables Necessary + Analytics cookies - **Reject non-essential** — enables only Necessary cookies - **Customize** — opens a panel where you can toggle individual categories
Your choice is stored in the `nself_consent` cookie and `localStorage.nself_consent` with the following structure:
``` {version: "1.0", categories: ["necessary", "analytics"], timestamp: "2026-04-14T12:00:00Z"} ```
### Changing your preferences
You can change your cookie preferences at any time by clicking "Cookie Preferences" in the footer of any page on nself.org.
### When we re-ask for consent
We will ask for your consent again if:
- The cookie policy version has changed since your last consent - More than 13 months have passed since your last consent (per ICO guidance) - You clear your browser cookies/storage
---
5. Browser-Level Controls
Most browsers let you control cookies through their settings:
- **Chrome:** Settings > Privacy and Security > Cookies - **Firefox:** Settings > Privacy & Security > Cookies and Site Data - **Safari:** Preferences > Privacy > Cookies and Website Data - **Edge:** Settings > Privacy, Search, and Services > Cookies
Blocking all cookies may prevent you from logging in to cloud.nself.org or task.nself.org. Necessary cookies are required for authentication.
---
6. Third-Party Scripts
We load the following third-party scripts, each gated behind the appropriate consent category:
| Script | Category | Loaded when | Purpose | |--------|----------|-------------|---------| | Google Analytics (gtag.js) | Analytics | Analytics consent granted | Usage analytics | | Plausible (self-hosted) | Analytics | Analytics consent granted | Privacy-friendly analytics | | Stripe.js | Necessary | On checkout pages only | Payment processing |
No third-party advertising scripts are loaded. No social media tracking pixels are used.
---
7. Contact
If you have questions about our use of cookies, contact privacy@nself.org.