2.1 Essential (always on)

These are necessary for the Service to work, so they cannot be turned off:

• Sign-in and security — Better Auth session cookies keep you signed in (up to 30 days), plus short-lived cookies used during Google sign-in, two-factor authentication, and when our staff provide support from within your account.

• Bot protection — Cloudflare Turnstile runs on the sign-in, sign-up, and password-reset pages to block automated abuse.

• Connecting services — a short-lived cookie (10 minutes) secures the connection flow when you connect Box, Granola, or another service.

• Payments — Stripe Checkout runs on Stripe’s own pages and sets its own cookies there.

• Error monitoring — Sentry detects and diagnoses technical errors in the app. It does not record your session unless you accept analytics (see 2.4).

Our website also loads fonts from Google Fonts, which receives your IP address but sets no cookies.

2.2 Functionality

These remember your choices and help the Service work as you expect:

• Your cookie choice — stored in a single novra_consent cookie on getnovra.ai, so the same choice applies on our website and in the app.

• Referral links — if you arrive through a colleague’s referral link, a first-party novra_ref cookie remembers the referral for up to 30 days so it can be credited when you sign up.

• Preferences — your theme (light/dark), sidebar layout (sidebar_state, sidebar_width, 7 days), and which tips and banners you have dismissed.

• Work in progress — the state of Neo’s chat panel and drafts you have not yet saved, such as a schedule you are setting up. These are kept in your browser and cleared when you sign out.

2.3 Performance

Vercel Analytics and Speed Insights in the app, and Framer Analytics on our website, measure page performance and aggregate usage. These are cookieless and store nothing on your device. Maps in the app are provided by Mapbox, which may store a small amount of data in your browser to report aggregate map usage.

2.4 Analytics (with your consent)

PostHog, our product analytics tool, and Sentry Session Replay are strictly consent-gated — neither loads, sets a cookie, or captures any data before you accept analytics. On our website PostHog records pageviews; in the app it records pageviews plus four named product events (signup, BOV generated, document uploaded, checkout started), with no autocapture. PostHog traffic is first-party proxied through app.getnovra.ai, and its identifier is shared between our website and the app so a visit can be connected to a later signup; app users are identified by user ID only. Session Replay records a sample of app sessions, with all text and media masked, to help us diagnose problems.

2.5 Marketing (with your consent)

With your consent, our website loads the LinkedIn Insight Tag to measure the effectiveness of our LinkedIn advertising and to build ad audiences. It is never loaded in the app, and it stays off whenever your browser sends a Global Privacy Control signal.