Cookie Policy

Cookie Policy

Last updated: 15 May 2026

This Cookie Policy describes which cookies and similar technologies Nanda uses, what they do, and how long they last. It sits alongside our Privacy Statement, which has the full picture of how we handle personal data.

What is a cookie?

A cookie is a small text file stored by your browser when you visit a website. Cookies help the site remember things like whether you are signed in, what preferences you have set, and (where you have consented) help the site owner understand how the site is used.

Cookies currently in use

Nanda always uses strictly necessary cookies. On our public website we also use Google Analytics 4 to understand aggregated site usage — but only if you turn the Analytics category on in the cookie banner. The Analytics category is off by default, and the Google Analytics script is not loaded at all until you give that consent. We do not run advertising or cross-site tracking cookies. If anything changes, we update this list and request prior opt-in consent where the law requires it.

Cookie Category Purpose Duration Party
_nanda_key Strictly necessary Phoenix session. Holds signed session data used to sign you in, maintain your login, and protect forms from CSRF. 30 days First-party
_nanda_token Strictly necessary (user-requested login) Guardian "remember me" cookie that keeps you signed in across sessions when you asked to stay logged in. 30 days First-party
nanda.consent Strictly necessary Stores the cookie-preference choices you made on our banner so we can respect them on future visits. 12 months First-party
_ga Analytics (consent required) Google Analytics 4. Distinguishes unique visitors to produce aggregated usage statistics. Set only after you enable the Analytics category. IP addresses are anonymised (truncated) and the full IP is not stored by Google. 2 years First-party cookie; data processed by Google as our processor
_ga_* Analytics (consent required) Google Analytics 4 session state for our specific property (cookie name ends in the property's container ID). Set only after you enable the Analytics category. 2 years First-party cookie; data processed by Google as our processor

Google Analytics is configured with IP anonymisation enabled and Google Signals disabled. The analytics script (gtag.js) is loaded from Google only after you opt in to the Analytics category — not on page load. Signed-in users are never tracked by analytics, regardless of cookie choices.

Cookie categories you can control

The cookie banner groups cookies into four categories. All non-essential categories are off by default and only set if you actively turn them on. The table below describes what each category would cover if it is enabled.

Category Default What it covers
Strictly necessary Always on Session, authentication, CSRF protection, and your cookie-preference record. Cannot be turned off because the site cannot function without them.
Functional Off Remembering preferences such as language and theme. Not currently in use.
Analytics Off Google Analytics 4 — aggregated usage statistics that help us understand which pages and features are working. The Google Analytics script is only loaded if you enable this category; nothing is sent to Google before then. IP anonymisation is enabled.
Marketing Off Includes any future partner-attribution or referral-tracking cookies set when you follow an outbound link to a partner site that pays Nanda a referral commission. These cookies do not carry your identity, email, or conversation data. Not currently in use.

Managing your cookies

  • Use the "Cookie settings" link in our footer at any time to review or change your choices.
  • You can also block or delete cookies through your browser settings.
  • Blocking strictly-necessary cookies will break sign-in and core site features.

Cookie-consent audit log

When you accept, reject, or customise cookie preferences, we store an anonymous record (timestamp, policy version, choices, browser user-agent, salted hash of your IP, locale) in our consent audit log. This is kept for 3 years so we can demonstrate to data-protection authorities that consent was captured lawfully. We never store your raw IP address.

Questions

Contact privacy@hinanda.com.