Last updated: October 19, 2026
This policy describes website cookies and similar storage. Optional vendor analytics and visitor identification are default off. These choices are separate from optional in-app usage measurement and diagnostics. Daily campaign totals for public page views, download requests and website signups do not use cookies, browser storage or visitor IDs. See our Privacy Policy for details.
Website account sessions and security controls use browser storage and private cookies as needed for authentication, recovery and restricted operator access. Operator cookies are HttpOnly, Secure and SameSite Strict, and expire after 15 minutes. Private backend credentials are not exposed to the browser.
The download deduplication cookie is a signed random first-party value with a non-sliding lifetime of 24 hours. It is HttpOnly, Secure and SameSite Lax. It suppresses repeated notifications for the same browser, platform and release; it does not identify a unique person. Expiry, deletion, cookie blocking or another browser can produce a new identity. Cookies are not proof that a download finished or the application was installed.
Google Analytics and Vercel Web Analytics measure permitted website activity under the usage analytics choice. Vercel Web Analytics runs only on our production website, with URL queries and fragments removed. RB2B is a separate visitor-identification integration and requires its own permission. An analytics or app usage grant does not silently enable RB2B. Vendor storage and retention depend on the vendor and configured service. We do not promise that vendor data is anonymous or that revocation erases information already sent.
With usage permission, campaign labels from tagged links are kept in this tab's session storage for up to 30 minutes after the latest tagged visit, so permitted download-button clicks and successful website registrations can be attributed to that campaign. A new tagged visit replaces the previous campaign. A registration measurement marker expires after one minute and is consumed once. These values contain no account identifier, email, password or advertising click ID. Revoking usage permission clears them. Before permission, campaign labels are held only in the current document's memory.
Optional first-party usage enrollment may use a pseudonymous browser visitor ID and session ID. Consented account association or an explicit pairing code can link a download with app activity. A pairing code expires after 15 minutes and does not authenticate an account, verify email or prove installation. Operational deduplication values, account email, passwords, verification tokens and pairing codes are not forwarded as analytics identities.
Verification, password recovery, pairing and operator pages do not load optional third-party analytics or identification scripts. Changing optional choices stops new dispatch; a page reload may be needed to remove a vendor already loaded in the current document.
to review separate analytics and visitor-identification choices at any time. App usage permission and diagnostics are controlled separately inside Nalana Settings.
Your browser can block or delete cookies and website storage. Blocking operational cookies may affect login or deduplication. Declining optional measurement does not prevent downloading or using local app features.
Optional raw measurement records and links are retained for up to 90 days; operational download records for 30 days; delivery audit records for 90 days; pairing records for 7 days with code secrets expiring after 15 minutes; nonidentifying daily aggregates for 13 months. Account policy state is retained for the account lifetime. Revocation stops new optional collection and clears pending uploads; it is separate from a request to delete historical records. See the Privacy Policy for deletion within 30 days and operational/security exceptions.
Questions about storage or choices? Email clarence@nalana.io.