Cookie Policy

1. The whole policy, in one paragraph

When you sign in to Nodes2Cloud we set a single session cookie so that the next page you load knows it is still you. That is the entire extent of our cookie use. We do not track you across sites, we do not build a profile of you, we do not sell or share any of it, and we do not use cookies for marketing. Everything below is elaboration.

2. Cookies we set

Technical properties, for the curious and for auditors:

• HttpOnly — JavaScript cannot read it, which limits the damage a cross-site scripting flaw could do.
• Secure — only ever transmitted over HTTPS in production.
• SameSite=None in production, because the editor and the API are on different subdomains and the cookie must accompany those requests. It is paired with Secure and a strict cross-origin policy on the API.
• The session record it refers to is held server-side and can be revoked by us or by you at any time.

The cookie is set by our API at api.nodes2cloud.com. It is a first-party cookie — no third party issues, reads or receives it.

This marketing website sets no cookies at all. You can browse nodes2cloud.com without any cookie being written.

3. Browser storage that is not a cookie

Two small values are kept in your browser’s local storage. Neither is personal data and neither is ever transmitted to us:

The editor also stores your workspace panel layout locally so the interface looks the same when you come back.

4. Why there is no cookie banner

Under the EU ePrivacy Directive and equivalent rules, consent is required before storing information on a user’s device unless it is strictly necessary to provide a service the user has explicitly requested.

A session cookie that keeps you logged in is the textbook example of strictly necessary. We set nothing else. So there is no consent to collect, and a banner would be theatre — an interruption that implies tracking we do not do.

If we ever introduce analytics or any non-essential cookie, we will implement a proper consent mechanism before setting it, and update this page.

5. What we deliberately do not use

This list is worth stating explicitly, because “no analytics” is unusual enough to be worth checking. None of the following appear anywhere in our website, editor or API:

• Google Analytics / Google Tag Manager
• PostHog
• Plausible
• Mixpanel
• Amplitude
• Segment
• LogRocket
• Hotjar
• Microsoft Clarity
• Facebook / Meta Pixel
• Any advertising or retargeting network

We also do not use tracking pixels, web beacons, fingerprinting, or session-replay recording.

6. Pages that are not ours

When you pay, you are taken to a checkout page hosted by Stripe or Razorpay. Those pages are operated by them and set their own cookies — typically for fraud prevention and to make the payment work. Similarly, signing in with Google or GitHub takes you briefly to their domains.

Those cookies are governed by the respective provider’s policy, not this one. The providers we use are listed on our Sub-processors page with links to their privacy policies.

7. Controlling cookies

You can block or delete cookies in your browser settings. Because our only cookie is the one that keeps you signed in, blocking it means you cannot use the editor — you will be signed out immediately on every action. Browsing this marketing site is unaffected.

To end a session deliberately, sign out. That invalidates the session server-side, not just in your browser.

8. Changes to this policy

If our cookie use changes, we will update this page and change the date at the top. Any introduction of a non-essential cookie will be accompanied by a consent mechanism.

Related reading: the Privacy Policy for personal data generally, and Sub-processors for the third parties involved. Questions to privacy@nodes2cloud.com.