Cookies
Cookies in the Pinavia app
The app sets only the cookies required to sign you in and keep your session secure. It sets no analytics cookies, no advertising cookies, and nothing that tracks you across sites — which is why you see no cookie banner here.
This notice is a complete draft prepared for legal review. It describes the cookies the product sets today, verified by direct inspection. If your procurement process requires a counsel-approved cookie notice before onboarding, request the reviewed version at hello@pinavia.io.
Why there is no cookie banner
Consent law asks for a choice where a choice exists. The app offers none to make: every cookie it sets is strictly necessary for signing in and holding a secure session, and consent rules exempt exactly that category.
A banner whose only category is a locked “always on” would be theatre — an interruption asking you to approve something that requires no approval. We publish this inventory instead, and commit to it staying true.
The complete inventory
Authentication runs through Clerk, and its session cookies are the only cookies the app sets. The section after this one covers the browser storage the app uses, which is not a cookie but is disclosed here for the same reason:
- __session — your signed-in session with this workspace. Expires when the session does.
- __client — identifies this browser to the sign-in service so your session can be refreshed securely.
- clerk_active_context — remembers which organisation and workspace you are acting in, so approvals are attributed to the right context.
Other browser storage
Cookies are not the only way a site can keep something on your device, and consent rules cover the rest of it too. The app also uses your browser's local and session storage. Settings and navigation history stay on this device. Decision drafts and operation-recovery data are used only when you submit, retry, or check that decision work. Clearing site data in your browser removes every entry:
- nexus.company-setup-helper.dismissed — remembers that you closed the setup guide so it does not reappear.
- pinavia.nav.collapsed — remembers whether you collapsed the sidebar to the icon rail.
- pinavia.palette.recents — the last few screens you opened from the search palette, so it can offer them first. This is the one entry that records where you went rather than a setting; it never leaves this browser.
- nexus_readiness_claim — carries your readiness-check claim code into onboarding. Cleared when you close the tab.
- pinavia:decision-draft — holds a decision you are part-way through writing while you move between screens. Cleared when you close the tab.
- pinavia:recommendation-decision-operation:v1 — holds one frozen recommendation-to-decision request, including its title, rationale, owner seat, deadline and status, plus an operation ID, request hash, saved time and an opaque binding to your current account and workspace. It lets the app check or safely retry the same operation after an interrupted response. Cleared after the saved record reopens successfully, when you close the tab, or when you clear site data.
- nexus:quorum-cycle-receipt:<record ID> and nexus:vantage-memo-receipt:<record ID> — one-time confirmations of a just-created governed record's server receipt. They contain an audit reference and are removed as soon as the reopened record reads them; they are not the audit record itself.
What the app does not set
No analytics cookies, no advertising or social-media pixels, no cross-site identifiers of any kind. Product analytics use Plausible, which is cookieless by design: it stores nothing in your browser and cannot follow you anywhere else. There is no Google Analytics, no session recording, and no fingerprinting.
The marketing site is governed separately
pinavia.io — the public marketing site — has its own cookie controls, including a preference center reachable from its footer, because marketing surfaces may one day carry measurement that the product itself never will. Its consent choice is stored against pinavia.io only and does not follow you into the app.
If this ever changes
Adding any cookie beyond the sign-in set is a product decision, not a configuration change. It would require consent infrastructure to ship first, this notice to be revised with a new effective date, and existing customers to be told. Until all three happen, the two inventories above are the complete list, and a test in the codebase fails if the app starts writing a browser-storage key this page does not name.