Legal
Cookie Policy
In short
This website sets no cookies unless you say yes. If you accept analytics in the cookie banner, Google Analytics sets two cookies so we can count visits in aggregate. If you reject, or never answer, it is not loaded at all.
The editor at app.nodes2cloud.com uses only strictly necessary cookies to keep you signed in, and runs no analytics. Nothing we run uses advertising or retargeting cookies. Change your choice any time with Cookie settings in the footer.
1. The whole policy, in one paragraph
On nodes2cloud.com we remember your light/dark preference and your cookie choice in your browser’s local storage, and — only if you accept — load Google Analytics, which sets the _ga and _ga_8RMLWS786T cookies. In the editor we set sign-in cookies that are strictly necessary for the service you asked for, and the sign-up, payment and Google file-picker steps involve third-party services that set their own. We do not track you across sites, build advertising profiles, or sell any of it.
2. This website (nodes2cloud.com)
| Name | Type | Purpose | Category | Lifetime |
|---|---|---|---|---|
n2c-home-theme | Local storage | Remembers whether you chose light or dark mode, so the page does not flash on load. | Strictly necessary (a setting you chose) | Until you clear it |
n2c-consent | Local storage | Records your analytics choice (accepted or rejected), the version of this banner you answered and when, so we do not ask on every page. | Strictly necessary (records your consent) | Until you clear it; we ask again after 12 months |
_ga | Cookie, set by Google Analytics on our domain | Distinguishes one browser from another so visits can be counted. Provider: Google LLC. | Analytics — only after you accept | 2 years |
_ga_8RMLWS786T | Cookie, set by Google Analytics on our domain | Keeps track of the current visit (session) for that count. Provider: Google LLC. | Analytics — only after you accept | 2 years |
Local storage values never leave your browser. The two Google Analytics cookies are sent to Google with the page-view data described in section 3.7 of our Privacy Policy. Google’s own description is in the Google Privacy Policy.
3. Your analytics choice
The first time you visit, a banner asks whether you allow analytics cookies. “Accept” and “Reject” are the same size, side by side, and rejecting costs you nothing: the whole site works the same either way.
- Before you choose, and if you reject, the Google Analytics script is not loaded, no request is made to Google from this site, and no analytics cookie is set.
- If you accept, we load Google Analytics with Google Consent Mode set so that only analytics storage is granted. Advertising storage, ad personalisation and ad user data stay denied, and we do not enable any advertising feature.
- To change your mind, select Cookie settings at the bottom of any page. Withdrawing turns Analytics off for the page you are on, deletes the
_gacookies for our domain, and stops it loading on every later page.
The legal basis for analytics is your consent (GDPR Art. 6(1)(a); the UK GDPR and PECR; and consent under the DPDP Act, 2023). You can withdraw it as easily as you gave it, and withdrawal does not affect what was measured before.
4. The editor (app.nodes2cloud.com)
When you sign in, our API at api.nodes2cloud.com sets the cookies below. They are strictly necessary: without them the editor cannot tell that the next request is still you. That is why they are set without asking — consent rules exempt storage that is strictly necessary for a service you explicitly requested. None of them is used for analytics or advertising, and no third party issues, reads or receives them.
| Name | Purpose | Category | Lifetime |
|---|---|---|---|
__Secure-cc_auth_session | Your sign-in session. Identifies your session to our API so you stay signed in. | Strictly necessary | 7 days, renewed while you use the editor; removed when you sign out |
__Secure-better-auth.session_data | A short-lived, encrypted copy of your session, so the API does not have to look it up on every request. | Strictly necessary | 60 seconds |
oidc_login_prompt, oidc_consent_prompt | Only while you approve an AI coding agent’s connection to your account (MCP sign-in): carries that request through the sign-in and consent screens. | Strictly necessary | 10 minutes |
Technical properties, for the curious and for auditors:
HttpOnly— JavaScript cannot read them, which limits the damage a cross-site scripting flaw could do.Secure, and the__Secure-name prefix — the browser only accepts and sends them over HTTPS.SameSite=None, because the editor and the API are on different subdomains and the cookie must accompany those requests. It is paired withSecureand a strict cross-origin policy on the API.- The session record the cookie refers to is held server-side and can be revoked by us or by you at any time.
5. Browser storage in the editor
The editor also keeps a few values in your browser’s local or session storage so features you use keep working: your panel layout, onboarding progress, the Cloudflare setup checklist, an unsent bug-report draft, a short-lived hand-off between the sign-in pop-up and the editor, and a marker used to recover when the app updates while you have it open. They stay in your browser and are not used for analytics.
6. Third-party services in the editor
Some steps involve a provider’s own page or script. Those providers may set their own cookies or similar storage, governed by their policies rather than this one:
- Cloudflare Turnstile — an anti-abuse check when you sign up, request an email verification code or ask for a password reset. It runs a script from Cloudflare that tells people from bots; it is not used for advertising. See Cloudflare’s privacy policy.
- Razorpay and Dodo Payments — when you pay, Razorpay’s checkout (customers billed in India) opens over the editor and Dodo Payments’ hosted checkout (everyone else) opens on Dodo’s site. Both set their own cookies, typically for fraud prevention and to make the payment work.
- Google and GitHub sign-in — signing in with either takes you briefly to their domains.
- Google Drive file picker — only if you open it to choose a file for a workflow, the editor loads Google’s picker scripts, and Google may set its own cookies.
The editor runs no analytics. The providers we use are listed on our Sub-processors page with links to their privacy policies.
7. What we do not use
Apart from opt-in Google Analytics on this website, none of the following appear anywhere in our website, editor or API:
- PostHog
- Plausible
- Mixpanel
- Amplitude
- Segment
- LogRocket
- Hotjar
- Microsoft Clarity
- Facebook / Meta Pixel
- Any advertising or retargeting network
We also do not use tracking pixels, web beacons, fingerprinting, or session-replay recording.
8. Controlling cookies
For analytics on this website, use Cookie settings in the footer. You can also block or delete cookies and site data in your browser settings; clearing site data for nodes2cloud.com also clears your recorded choice, so the banner will ask again.
Blocking the editor’s sign-in cookies means you cannot use the editor — you will be signed out on every action. To end a session deliberately, sign out: that invalidates it server-side, not just in your browser.
9. Changes to this policy
If what we store changes, we will update this page and the date at the top. If we ever ask for consent to something new, the banner will ask you again before it is set.
Related reading: the Privacy Policy for personal data generally, and Sub-processors for the third parties involved. Questions to privacy@nodes2cloud.com.