Version 1 · Effective Oct 12, 2026 · 4 min read
Cookie Notice
In short: only what keeps you signed in and secure is always on; preferences and privacy-friendly analytics are optional and off until you choose; no advertising or cross-site tracking.
Effective date: 12 October 2026
This notice explains what the Novagora web app at novagora.app and our admin console store in your browser or read from it, and how you control that. Storing and reading is governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG); any personal data involved is handled as the Privacy Policy describes.
The iOS and Android apps use no browser cookies. They keep on your device only what they need to run: your session in the device's secure storage, your preferences, a short cache of content you have seen, what you wrote but have not sent yet and, if you rate a help article while signed out, a random device ID.
1. Strictly necessary (always on)
These make the Service work, so they need no consent (§ 25(2) no. 2 TDDDG).
| What | Why | How long |
|---|---|---|
| Session cookies, including a short-lived one for the two-factor step | Keep you signed in and link your requests to your account | Until you sign out or revoke the session; otherwise a year after last use |
| Trusted-device marker for two-factor authentication | Remembers that you chose not to be asked for a code on this device | 30 days |
| Video playback cookies for the one video you play | Let your browser load a video you may watch from our media delivery network | 2 minutes |
| Bot-check tokens on sign-up, sign-in, password reset, the contact form and, for restricted accounts, before writing | Tell people from bots; our network security provider processes connection and device characteristics for this | For the check |
| Your cookie choice | Remembers your decision so we do not ask again | Until you change or clear it |
| Chat messages that failed to send, in local storage | Let you retry or discard them after a reload | Until sent, discarded or you sign out, at most 7 days |
| A random help reader ID, in local storage, written only when you rate a help article or release note while signed out | Keeps your vote to one and lets you change it | Until you clear your browser's site data |
| A flag in session storage when you choose Cancel deletion before signing in | Cancels a pending account deletion only when you asked for it | Until the tab is closed |
2. Preferences (optional)
Your choices for theme, reduced motion, page width, list and calendar views, collapsed sidebar sections, recently used emoji and searches, the last owner scope you picked, and the referral link you arrived through (so signing up within 30 days still credits it). They live in your browser's local storage, are read only by the web app and are written only after you allow them; until then they last until you reload the page.
3. Analytics (optional)
Analytics covers our own web product analytics and browser error monitoring. Your browser sends nothing for either before you consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR).
Web analytics: we run it ourselves on our EU hosting under our own domain, and it sets no analytics cookies. It processes browser and device information, an approximate location derived from the connection and cleaned page and referrer addresses; when you are signed in, your internal user ID links visits and devices, so the data is pseudonymous. Sampled replays and heatmaps show how pages are used, with input masked and sensitive areas blocked (chats, note bodies, file previews, two-factor secrets, export links and member, moderation and audit lists). Your written content, email address, search text and link tokens are never sent, and the admin console and mobile apps are not tracked. We keep analytics only as long as needed to compare use over time and replays only as long as needed to investigate a problem (Privacy Policy, sections 7 and 8).
Browser error monitoring: crash and error reports with a sample of performance timings go to our error-monitoring provider in the United States (Privacy Policy, section 6). A report contains the error, the page, your browser type, the app version and a technical trace, but not your name, email or content.
Withdrawing consent stops further collection and error reporting; it does not recall what was already sent, so contact [email protected] for access or erasure. Our servers' own error logs and the anonymous subscription counts described in the Privacy Policy store nothing on your device and do not depend on this choice.
4. What we do not do
No advertising cookies, social media pixels or cross-site tracking. We do not sell analytics data or build advertising profiles.
5. Your choices
On your first visit a banner offers Accept all and Reject all with equal weight, and Manage for each category. Nothing optional is stored before you choose, and rejecting never limits what you can do. You can change your choice at any time in Cookie preferences: in the footer of public pages, under Settings → Privacy and in the admin console's account menu. Withdrawing removes the optional storage. Clearing your browser's site data resets your choice and the banner appears again.
6. Changes
We update this notice when what the site stores changes. Each edition has a version number and an effective date. If a change adds optional storage, the banner asks again; an earlier choice never covers storage it did not name.
7. Contact
[email protected], for questions about this notice and storage in your browser.