This policy explains what Nordic Stars stores in your browser. In summary: one first-party session cookie when you sign in, a handful of local preferences, and no analytics or marketing cookies at all — on the website or in the app. The website’s analytics are cookieless and run only if you allow them, and you can change your answer at any time.
1. Cookies we set
| Cookie | Purpose | Set by | Duration |
|---|---|---|---|
__Host-ns_session | Keeps you signed in to the app. Strictly necessary; set only when you sign in. HttpOnly, Secure, SameSite — never readable by scripts, never shared cross-site. | Goose Yard Sailing AB (first party) | 30 days |
That is the whole table. Visitors who never sign in get no cookies from us.
One third party can set cookies of its own: a YouTube video your team has linked to a debrief. Its player loads in YouTube’s privacy-enhanced mode (youtube-nocookie.com), which sets no cookies until you press play. From then on YouTube’s own cookie policy applies to that player, and to nothing else on the page.
2. Local storage (not cookies)
The app keeps functional preferences in your browser’s local storage. This data stays on your device, is not sent with requests, and is never used for tracking:
- Sign-in state — Google Cloud Identity Platform (Firebase Authentication) keeps its session material in browser storage while you are signed in.
- Player preferences — layout and view choices in the debrief player (keys prefixed
ns.: explorer layout, overlay preset, track mode, and similar). - Local video memory — references to onboard video files you attached, so they re-open next session. The video itself never leaves your machine.
- Your cookie choice — the consent decision itself (key
ns.consent.v1): which categories you allowed and when you decided. It is a local preference, not a cookie — it is never sent with requests.
3. Your choice — the consent bar
The website shows a consent bar on your first visit. It asks about two categories:
- Strictly necessary — the session cookie above. Always on: signing in is impossible without it, and it needs no consent.
- Analytics — off unless you turn it on. Nothing in this category runs before you allow it.
Your answer is stored on your device under ns.consent.v1 (see above) so we can respect it on every visit. To change your mind, use “Cookie preferences” in the page footer — it reopens the same panel showing your current choice, and withdrawing consent is exactly as easy as giving it. If we ever change what a category covers, the bar asks again instead of assuming your old answer still applies.
4. Analytics — cookieless, and only with your consent
The marketing pages count visits with Plausible. It is cookieless: it stores nothing on your device and sets no cookie, which is why the table in section 1 gained no row when it arrived. It records aggregate usage only — which page, where you arrived from, country and device type, and when a visit clicks a link off the site, downloads a file or submits a form. It records nothing you type into a field, builds no profile of you and keeps no record that follows you to other websites. We load no advertising or social tracking of any kind.
The script loads only after you have allowed the analytics category — an undecided visit or a “necessary only” choice keeps it off entirely, and a choice you have already made is honored without asking again. Withdraw consent and it stops loading. Analytics never load inside the app, for any customer and on any plan.
5. Managing cookies
The “Cookie preferences” link in the footer changes your consent choice at any time. Beyond that, you can clear or block cookies in your browser settings. Blocking __Host-ns_session makes signing in impossible:
- Chrome: Settings → Privacy and security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
6. Changes and contact
Material changes to this policy are announced in advance and dated above. Questions: privacy@nordicstars.ai. See also the Privacy Policy.