Cookie Policy

This policy covers the NovaBuild marketing site, the signed in application, the public project share pages and the documentation. It does not cover applications you build with NovaBuild and deploy yourself. Those are your sites, and you are responsible for publishing your own cookie notice and collecting consent where required.

A cookie is a small text file a site asks your browser to store and send back on later requests. Related technologies do similar jobs: local storage and session storage keep values on your device without sending them automatically, and pixels or beacons signal that a page or email was opened. We describe all of these together as cookies in this policy.

Cookies are first party when they are set by novabuild.dev, and third party when they are set by another domain loaded on the page. Session cookies disappear when you close the browser. Persistent cookies last until they expire or you delete them.

These cookies are set on the basis of necessity, not consent, because the signed in application cannot work without them. Blocking them will sign you out and break agent runs, previews and deploys.

These values never leave your device automatically. Clearing site data resets them to the defaults.

We measure aggregate product usage so we can see which flows fail, which pages are slow and where agent runs break. Analytics events are first party, keyed to a rotating pseudonymous identifier rather than to your email, and never used to build advertising profiles or sold to anyone.

• Events recorded include page views, prompt submissions, run outcomes, build failures and deploy outcomes.
• We record coarse location derived from IP at country level, and we do not store the full IP alongside analytics events.
• Public project share pages record anonymous view counts and referrer domains so project owners can see traffic.
• You can opt out of product analytics in workspace settings, and the app then stops emitting these events for you.

Where the law requires consent for analytics, we ask before the first analytics event is sent, and we treat a refusal as a durable choice recorded in nb-cookie-choice.

Project previews are served from an isolated sandbox domain inside an iframe. That domain may set its own technical cookies to route requests to the right container and to keep the hot reload channel open. Those cookies belong to the preview session, are cleared when the sandbox stops, and carry no profiling data.

• No advertising or retargeting cookies, and no advertising network pixels.
• No cross site tracking, no data broker enrichment, no fingerprinting scripts.
• No session recording or keystroke capture of your prompts or code.
• No social media share buttons that phone home before you click.

If you are in a jurisdiction that requires prior consent for non essential storage, you see a banner on first visit with a clear accept and reject choice, and reject is as easy as accept. You can change your mind at any time from the cookie preferences link in the footer or from workspace settings. Withdrawing consent stops future analytics events and does not affect strictly necessary cookies.

Every major browser lets you view, block and delete cookies, and clear local storage, from its privacy settings. Look for "Cookies and site data" in Chrome and Edge, "Cookies and Site Data" in Firefox, and "Privacy" in Safari. You can also use a private window to keep storage for one session only.

We honour the Global Privacy Control signal as an opt out of non essential analytics. Browser Do Not Track headers have no agreed meaning, so we treat them the same way, which means we also stop non essential analytics when we see one.

Generated projects can use cookies, local storage and third party scripts. When you deploy such a project you become the operator of that site. You are responsible for a cookie notice, for a lawful consent mechanism where required, and for keeping the inventory accurate. Ask an agent to scaffold a cookie banner and policy page for your project if you need one.

• Session and authentication cookies expire on the lifetimes listed in section 4.
• Rate limit counters are discarded within 24 hours.
• Analytics events are retained in aggregate for 14 months, then deleted or rolled into counts with no identifiers.
• Public page view records keep a referrer domain and a date, and no visitor identifier beyond a rotating hash.

When we add or remove a cookie we update the tables above and the effective date. Material changes to non essential storage are announced in the app, and where consent is required we ask again rather than relying on an old choice.

Questions about this policy or a specific cookie: privacy@novabuild.dev. We are happy to confirm the current inventory in writing for procurement reviews.