# Cookie Policy

Version 1.1 · effective from 2026-08-16

## 1. Purpose

This Policy describes cookies, local storage and session storage used by niblo.app, separating essential and optional technologies and identifying purpose, provider and duration.

## 2. Technologies

A cookie is a small value exchanged with the server. `localStorage` keeps a preference on the device after closing the browser; `sessionStorage` normally ends when the tab closes. These values are not executable programs and cannot independently read unrelated files.

## 3. Legal basis

Storage strictly necessary for transmission, security, session continuity and a function expressly requested by the User is used without separate consent under applicable electronic-communications law. Optional analytics, non-requested personalisation or advertising requires prior consent where applicable.

Optional analytics and marketing cookies are currently disabled. “I understand” only stores that the information was closed and is not marketing consent.

## 4. Server technology register

| Technology | Provider | Purpose | Typical duration |
| --- | --- | --- | --- |
| niblo.app session cookie | Operator | authentication, session continuity and Account protection | session or configured server lifetime |
| `XSRF-TOKEN` or equivalent | Operator | cross-site request forgery protection | session |
| server language preference, where used | Operator | requested language | until changed or expired |

The exact session-cookie name depends on environment configuration. Authentication cookies use appropriate `HttpOnly`, `Secure` and `SameSite` attributes where applicable.

## 5. Local storage register

The device may retain theme, light/dark mode, fonts and accessibility preferences; navigation and Dashboard layout; recently selected views and filters; document editing settings and offline queue; client identifier needed for synchronisation; chat-window state and local encryption trust information; recent reactions and shortcuts; and cookie-notice acknowledgement.

Some settings may sync to the Account. Local values remain on that device until changed, removed by the application or cleared as site data.

## 6. Session storage

Session storage may preserve an open panel, filter or conversation transition while navigating. It normally disappears when the tab or browser closes.

## 7. Third parties

Public niblo.app pages currently load no third-party advertising or analytics cookies. Opening an external News publication takes the User to the publisher’s website and its policies. Displaying a title or image in niblo.app should not execute the publisher’s scripts.

Before adding optional analytics, embedded media, maps or advertising, this register and the consent mechanism will be updated.

## 8. Managing settings

Cookie information can be reopened from the footer. With no optional categories active, the panel is informational. Browser settings can remove site data. Blocking session or CSRF cookies prevents login and form submission. Clearing local storage resets device preferences and local queues but does not erase server Account data.

## 9. Privacy signals

Any future optional technology will respect the User’s choice. As standards such as Global Privacy Control mature, the Operator will assess support as an objection or consent-withdrawal signal.

## 10. Updates and contact

The register is reviewed when frontend, authentication, providers or modules change. Questions may be sent to contact@niblo.app. Include browser, device and cookie name, but never send session-token values.