Cookie Policy

Last updated 22 August 2026

This policy explains the cookies and similar local storage NexoSphere uses. We keep this deliberately minimal — we do not use third-party advertising or cross-site tracking cookies.

1. Strictly necessary

These are required for the platform to work and cannot be switched off:

Session — after you sign in, a secure, HTTP-only session cookie keeps you logged in. It is removed when you sign out.
Preferences — small cookies (nexo_rail, nexo-locale) remember your layout and language choices.
Security & sign-in — short-lived nexo_* cookies cover sign-in step-up, workspace lock, device trust, email OTP at sign-up, single sign-on state, passkey challenges, and optional push-notification registration; request metadata is also used transiently for rate-limiting and abuse prevention.

2. Optional (consent-based)

Any product-analytics or non-essential storage is used only if you opt in. Analytics is off by default, and you can change your choice at any time in your privacy settings. We do not load non-essential trackers before you consent.

3. Third parties

Some features load resources from the providers that operate them — for example real-time calls (LiveKit) and images/media served from our storage provider. These are used to deliver the feature, not to track you across other websites.

4. Controlling cookies

You can clear or block cookies in your browser settings, but blocking strictly-necessary cookies will stop you from signing in. You control optional storage through your NexoSphere privacy settings.

5. More information

See our Privacy Policy for how we handle personal data more generally.

1. Strictly necessary

These are required for the platform to work and cannot be switched off:

Session — after you sign in, a secure, HTTP-only session cookie keeps you logged in. It is removed when you sign out.

Preferences — small cookies (nexo_rail, nexo-locale) remember your layout and language choices.

Security & sign-in — short-lived nexo_* cookies cover sign-in step-up, workspace lock, device trust, email OTP at sign-up, single sign-on state, passkey challenges, and optional push-notification registration; request metadata is also used transiently for rate-limiting and abuse prevention.