Skip to content
NovasHQ
Sign inCreate account

Legal document

Cookie and Local Storage Notice

Last updated29 July 2026

The Service uses only security, authentication and interface storage needed to sign users in, protect requests and remember workspace preferences. It does not currently use advertising or analytics cookies.

1. Cookies we set

NamePurposeTypical duration
__Host-novas_sessionStrictly necessary, HTTP-only authentication session. Secure in production and SameSite=Lax.12 hours
__Host-novas_csrfStrictly necessary, HTTP-only anti-forgery token used to protect state-changing requests. Secure in production and SameSite=Strict.10 minutes

Development environments use the equivalent names novas_session and novas_csrf. These cookies are necessary for the requested Service and are not used to track users across websites.

2. Local browser storage

Key or categoryPurposeDuration
novas-crm-sidebar-sectionsRemembers which navigation groups are open.Until changed or browser storage is cleared
novas-crm-leads-priority-filterRemembers a selected lead-priority filter.Until cleared or reset
novas-crm-calls-priority-filterRemembers a selected calls-priority filter.Until cleared or reset
novas-ai-agent-conversationStores a random conversation identifier so the signed-in user can restore the correct server-side AI chat history. It does not contain the conversation text.Until a new chat is started or browser storage is cleared
Firebase Authentication storageTemporarily completes Google or email/password authentication before the Service exchanges the Firebase token for an HTTP-only server session and signs out the browser SDK.Provider-controlled and normally cleared after session exchange

3. Third-party pages

When you choose Google sign-in, connect Gmail, open Stripe Checkout or use the Stripe billing portal, Google or Stripe may set cookies on their own domains under their notices. Those cookies are not set by this Service and may include fraud-prevention, account and payment-security cookies.

4. Consent and control

Strictly necessary authentication and security storage is used because the Service cannot function securely without it. We do not currently set non-essential analytics, personalisation or advertising cookies, so the Service does not display a consent banner. If that changes, we will update this notice and request consent before setting non-essential cookies where required.

You can clear local storage and cookies in browser settings, but doing so signs you out and resets preferences. See the Privacy Notice for broader data information.

5. Contact

Questions can be sent to help@novasagency.com.