Cookie Policy
Cookie Policy
Version: 1.0 (DRAFT) Effective date: May 15, 2026 Last updated: April 14, 2026
1. What Are Cookies
Cookies are small text files stored on your device when you visit a website. They serve various purposes: keeping you logged in, remembering your preferences, and helping us understand how people use our site.
We also use localStorage for client-side preference storage. Where relevant, we treat localStorage entries the same as cookies for consent purposes.
2. Cookie Categories
We organize cookies into three categories:
Necessary (always active)
These cookies are required for the site to function. They cannot be disabled.
Analytics (opt-in)
These cookies help us understand how visitors use our site. They are only set after you consent.
Marketing (not currently used)
We do not currently use any marketing or advertising cookies. If we add them in the future, they will require your explicit consent before being set.
3. Cookie Audit Table
The following table lists every cookie and storage entry used across nself.org and its subdomains. This table is regenerated periodically from an automated audit.
| Cookie / Storage Key | Set By | Category | Purpose | Duration | Domain |
|---|---|---|---|---|---|
next-auth.session-token | ɳSelf (NextAuth) | Necessary | Authentication session for logged-in users | 30 days | cloud.nself.org, task.nself.org |
next-auth.csrf-token | ɳSelf (NextAuth) | Necessary | CSRF protection for authentication flows | Session | cloud.nself.org, task.nself.org |
next-auth.callback-url | ɳSelf (NextAuth) | Necessary | Stores redirect URL during auth flow | Session | cloud.nself.org, task.nself.org |
nself | ɳSelf | Necessary | Records your cookie consent preferences | 1 year | *.nself.org |
_stripe_sid | Stripe | Necessary | Fraud detection during checkout | Session | cloud.nself.org |
_stripe_mid | Stripe | Necessary | Fraud detection (device fingerprint) | 1 year | cloud.nself.org |
_ga | Google Analytics | Analytics | Distinguishes unique visitors | 2 years | *.nself.org |
_ga_* | Google Analytics | Analytics | Maintains session state for GA4 | 2 years | *.nself.org |
plausible_ignore | You (opt-out) | Analytics | Self-set opt-out flag — tells Plausible to ignore your visits. Not set by us. | Persistent | *.nself.org |
localStorage Entries
| Key | Category | Purpose | Set when |
|---|---|---|---|
nself | Necessary | Mirror of cookie consent state (version, categories, timestamp) | On consent decision |
theme | Necessary | Dark/light mode preference | On theme toggle |
4. How to Manage Your Preferences
Cookie banner
On your first visit, a cookie banner appears at the bottom of the page with three options:
- Accept all: enables Necessary + Analytics cookies
- Reject non-essential: enables only Necessary cookies
- Customize: opens a panel where you can toggle individual categories
Your choice is stored in the nself cookie and localStorage.nself_consent with the following structure:
{version: "1.0", categories: ["necessary", "analytics"], timestamp: "2026-04-14T12:00:00Z"}Changing your preferences
You can change your cookie preferences at any time by clicking “Cookie Preferences” in the footer of any page on nself.org.
When we re-ask for consent
We will ask for your consent again if:
- The cookie policy version has changed since your last consent
- More than 13 months have passed since your last consent (per ICO guidance)
- You clear your browser cookies/storage
5. Browser-Level Controls
Most browsers let you control cookies through their settings:
- Chrome: Settings > Privacy and Security > Cookies
- Firefox: Settings > Privacy & Security > Cookies and Site Data
- Safari: Preferences > Privacy > Cookies and Website Data
- Edge: Settings > Privacy, Search, and Services > Cookies
Blocking all cookies may prevent you from logging in to cloud.nself.org or task.nself.org. Necessary cookies are required for authentication.
6. Third-Party Scripts
We load the following third-party scripts, each gated behind the appropriate consent category:
| Script | Category | Loaded when | Purpose |
|---|---|---|---|
| Google Analytics (gtag.js) | Analytics | Analytics consent granted | Usage analytics |
| Plausible (self-hosted) | Analytics | Always loaded (see note below) | Privacy-friendly, cookie-free analytics |
| Stripe.js | Necessary | On checkout pages only | Payment processing |
Plausible Analytics — GDPR recital 47 note: Plausible uses no cookies and stores no persistent identifiers. All data is aggregated. Under GDPR recital 47, anonymous analytics performed in the legitimate interest of the data controller are consent-exempt where those interests are not overridden by the data subject’s interests or rights. Because Plausible collects no personal data and sets no cookies (the plausible_ignore entry in the cookie table is an opt-out flag you set, not a tracking cookie we set), we rely on legitimate interest as the lawful basis. You can opt out at any time by setting plausible_ignore=true in your browser’s localStorage for *.nself.org.
No third-party advertising scripts are loaded. No social media tracking pixels are used.
7. Contact
If you have questions about our use of cookies, contact privacy@nself.org.