1. Essential and preference storage
The application uses browser storage for account-session persistence and interface preferences. Authentication may use a browser-readable token cookie to authenticate application requests. Treat that cookie as sensitive: it is not an HttpOnly server session. The public marketing export itself does not set a session cookie, but opening sign-in and connected services can cause additional storage or requests.
| Item | Purpose | Duration / control |
|---|---|---|
| northstone.theme (local storage) | Remember light or dark appearance | Persists until changed or browser storage is cleared |
| Account authentication (Firebase storage and northstone.firebase-id-token cookie) | Maintain and authenticate the selected sign-in session | Cookie is session-scoped; browser persistence depends on Remember me, renewal and sign-out. This is not all-data deletion. |
| Workspace interface preferences | Remember selected layout or navigation state | May persist in browser storage; clear site data to reset local preferences |
| Local profile and settings (northstone.profile / northstone.preferences) | Store the name/email entered in profile settings and notification or automation preferences | Persists locally until changed or site storage is cleared; these local settings are not a privacy-rights request or server-side permission change |
| Development/demo draft content | Keep local command drafts, deal-room names, automation drafts, and integration staging choices in fixture workflows | Can persist locally between visits; avoid entering sensitive information in development workflows and clear site storage when finished |
| Demo-only fixture session | Support a development/demo session | Local or session storage depending on the demo’s remember setting; not customer production authentication |
2. External services and optional tracking
Google Fonts is requested by the current site. OpenFreeMap receives map tile/style requests when maps load. Authentication and enabled integrations can also send ordinary network-request information to their providers. These requests must be included in the operator’s verified inventory; browser storage and third-party requests are different types of processing.
No optional analytics or advertising consent is collected by the current legal pages. A cookie banner is not a substitute for preventing optional processing before valid consent. Before adding analytics, advertising pixels, session replay, or profiling technologies, classify them, document recipients and lifetimes, and implement applicable opt-in and withdrawal controls. Review California sale/sharing and Global Privacy Control requirements separately.
3. Manage storage and requests
You can sign out, adjust the theme, block cookies, or clear site data in your browser. Blocking authentication storage may prevent sign-in. Clearing local data does not delete server records or provider records. Use the privacy-request contact for those requests.
Do Not Track is not a uniform legal consent mechanism. This draft does not claim an implemented response to every browser signal. Required opt-outs, including qualifying Global Privacy Control signals, must be verified before a final California notice is approved.
4. Inventory and updates
The final inventory must confirm production cookie names, hosts, categories, lifetimes, and provider policies using the actual deployed configuration. Ask support@loomlogic.io about privacy choices. Material changes to optional purposes may require new notice or consent.
Official references
These sources explain the relevant frameworks. Applicability and implementation must be assessed for the actual service.
Requests and questions: support@loomlogic.io