NEXUS · November 2, 2026

Cookie Policy

Draft policy. Confirm actual cookie behavior, jurisdictions and consent requirements with the product owner and qualified legal counsel.

Necessary session and CSRF cookies

NEXUS uses an HTTP-only session cookie marked Secure and SameSite=None for the hosted HTTPS embedded preview. The random session token is accepted only from this cookie; the server stores its SHA-256 hash, and no session bearer token is stored in browser storage. A separate readable CSRF token is checked on state-changing requests. Browser third-party-cookie restrictions may block cross-site login in some embedded contexts; no bearer fallback is used.

Optional analytics and marketing

Optional site analytics and marketing trackers are disabled in the current project configuration. No optional tracker should be activated before an appropriate consent mechanism and owner approval.

Controls and contact

Browser controls can restrict cookies, which may prevent sign-in in embedded Preview. The owner should add a verified privacy contact and jurisdiction-specific consent controls before public operation. Last updated: November 2, 2026.

Back to NEXUS