Cookie policy
How Nearpin uses cookies — short version: only the strictly necessary ones, and nothing that tracks you.
Why Nearpin has no cookie-consent popup
Nearpin does not set advertising, analytics or other third-party/tracking cookies. The cookies the app sets are strictly necessary to keep you signed in and protected against cross-site request forgery: cookies of this kind are exempt from consent under every regime that applies (DPDP Act 2023 — necessary processing; the EU/UK ePrivacy rules echo the same exemption). That is also why the consent banner is off by default — there is nothing non-essential to consent to.
The cookies we set
| Cookie | Purpose | Type | When set |
|---|---|---|---|
nearpin_session |
Holds your signed-in web session (server-side store). | Strictly necessary, first-party, HttpOnly | After you sign in |
__Host-csrf-token (or csrf-token in dev) |
Cross-site-request-forgery protection on every form. | Strictly necessary, first-party | Every public page |
nearpin_oauth_state |
Binds the Google sign-in request to your browser (login CSRF + PKCE). | Strictly necessary, first-party, HttpOnly, short-lived (10 min) | On the sign-in page |
What we do NOT do
- No advertising cookies, fingerprinting, or cross-site tracking.
- No third-party embeds that set their own cookies on our pages (YouTube embeds use the privacy-enhanced
youtube-nocookie.comhost). - No persistent identifiers beyond your own signed-in session.
Cookie-consent banner is currently off because no non-essential cookies are in use.