Sign-in and security
The application uses __Host-nonono_session, an HttpOnly, Secure, SameSite=Lax session cookie on production HTTPS. It expires after 12 hours and is used to authenticate your session. Signing out or revoking the session invalidates access. Development environments use a differently named nonono_session cookie; they are not the production service.
The separate client portal uses __Host-nonono_client, an HttpOnly, Secure, SameSite=Lax cookie on production HTTPS. It expires after 12 hours and authenticates portal access only. The two session cookies do not grant access to each other's application.
Your interface preferences
Local browser storage remembers nonono-locale (chosen language), nonono-workspace (last workspace) and nonono-sidebar-collapsed (navigation preference). These remain until you change them or clear site storage. They are not advertising profiles. Browser storage does not grant workspace access; the server still checks your permissions.
During the public business check, session storage keeps nonono-public-journey, a temporary resume token for that browser tab. A resume link can also contain this token in its URL fragment. It does not by itself confirm payment or confer portal access. Closing the tab or clearing site data removes the browser copy; a server-side expiry still limits use of the token.
Campaign measurement
Page experiments carry a signed assignment for the current rendered page, without setting a persistent experiment cookie. A later visit may see a different variant. Legacy experiment cookies are expired when encountered by the public page API and are no longer used for repeat-visit assignment. Page views are counts of rendered pages, not unique individuals.
Optional advertising measurement uses a separate unchecked choice naming the recipient and purpose. If accepted, permitted click identifiers and limited browser information may be saved with that consent. Declining does not prevent an enquiry. This feature does not load an advertising pixel or install an advertising cookie. A later external service may have its own storage practices, which must be disclosed before activation.
Control and future changes
You can remove site storage in your browser. Removing the session cookie signs you out; removing preferences resets them. No optional third-party support widget or cross-site advertising tracker is enabled by this policy. If non-essential storage is introduced, it must have an appropriate choice before loading, an equally accessible refusal option and a way to change the choice later.