Last updated: September 22, 2026

NODEFOX COOKIE POLICY

Version 1.1 | Effective Date: September 22, 2026 | Last Updated: September 22, 2026

Beta Status Notice: NodeFox is currently provided in beta. Features, behavior, documentation, and controls may change without notice. You must independently validate suitability for your use case and maintain your own safeguards.

© 2025–2026 NodeFox LLC. All rights reserved.

---

Important Notice

This Cookie Policy ("Policy") explains how NodeFox LLC ("NodeFox," "Company," "We," "Us," or "Our") uses cookies and similar tracking technologies when you visit our website, use our platform, or interact with our services.

This Policy supplements our Privacy Policy and Terms of Service. By using the Services, you acknowledge that you have read and understood this Policy. This acknowledgment does not constitute consent for non-essential cookies. In jurisdictions requiring consent for non-essential cookies, we obtain your consent via our cookie banner before placing such cookies.

---

Key Points Summary

This summary is for convenience only. The full Policy controls.

---

Section 1. Introduction and Scope

1.1 This Policy explains what cookies and similar tracking technologies are, how we use them, and how you can control them. This Policy supplements our Privacy Policy and should be read together with it. The Terms of Service govern the contractual relationship.

1.2 Scope. This Policy applies to our website at https://www.nodefox.ai and subdomains, the NodeFox platform and web application, marketing and documentation pages, and any other online services where this Policy is posted.

1.3 Application. This Policy applies to all visitors, users of the Services, and recipients of our emails whose devices interact with the Services.

1.4 Desktop Application. The Desktop Application uses limited tracking technologies as described in the EULA and Privacy Policy. This Policy focuses primarily on web-based cookies and tracking.

---

Section 2. What Are Cookies

2.1 Cookies are small text files placed on your device when you visit a website. They are used to enable functionality, remember preferences, maintain sessions, provide security, and understand usage.

2.2 A cookie typically contains: the domain that set it, a lifetime, and a value (usually a unique identifier).

2.3 Cookies may be set by the website you visit (first-party) or by third-party services integrated into the website (third-party).

---

Section 3. How Cookies Work

3.1 When you visit a website, cookies are sent to your browser and stored on your device. When you return, the website reads the cookie to recognize you and retrieve preferences.

3.2 Cookies have attributes controlling their behavior: Name, Value, Domain, Path, Expires/Max-Age, Secure (HTTPS only), HttpOnly (not accessible to JavaScript), and SameSite (cross-site behavior).

---

Section 4. Types of Cookies

4.1 Session Cookies. Temporary; stored in browser memory and deleted when you close your browser. Used for authentication, session management, and security.

4.2 Persistent Cookies. Remain on your device for a specified period or until manually deleted. Used for preferences, returning user recognition, and analytics.

4.3 First-Party Cookies. Set by nodefox.ai or its subdomains. We control these directly.

4.4 Third-Party Cookies. Set by domains other than nodefox.ai by services we integrate (analytics, security, payment). We limit third-party cookies to essential service providers and those you consent to where required by law.

---

Section 5. Categories of Cookies We Use

Our cookie banner presents three categories. The names below are the names you will see on the banner.

---

Section 6. Strictly Necessary Cookies and Local Storage

6.1 Strictly necessary cookies and storage are essential for the Services to function. They do not require consent under most privacy laws because they are necessary to provide the service you requested.

6.2 These cannot be disabled through our cookie preference mechanisms. Blocking them via your browser may impair functionality.

6.3 Strictly necessary cookies and storage include:

• Authentication: Identify you when logged in, maintain sessions, verify identity
• Security: CSRF protection, bot detection, rate limiting, request integrity
• Session Management: State maintenance, navigation tracking, form data, timeouts
• Load Balancing and Edge Routing: Traffic distribution, geographic routing, consistent session routing, availability
• Cookie Consent: Recording your cookie preferences

6.4 Local-First Architecture (Strictly Necessary). Because the Services utilize a local-first, WebAssembly (WASM) architecture, the use of IndexedDB, local storage, session storage, and the Origin Private File System (OPFS) to store Workflow states, execution data, application configurations, and cached content is classified as Strictly Necessary for performance of the contract. This local data storage is fundamental to the operation of the Services, is not used for tracking or advertising, and cannot be declined via cookie consent mechanisms.

6.5 Strictly necessary cookies are typically session cookies, first-party, secure, and HttpOnly.

---

Section 7. Functional Cookies

7.1 Functional cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we integrate.

7.2 Functional cookies are used strictly for user-requested features such as language/display preferences, theme settings, feature configurations, recently accessed items, and onboarding state. They are not used for advertising profiling, behavioral tracking, or cross-context analytics.

7.3 Functional cookies sit in the Personalization category on our banner and are off by default. They require consent in jurisdictions that mandate it. You can decline them on the banner or block them through browser settings, though doing so may affect convenience features. To change a choice you have already made, see Section 16.2.

7.4 Functional cookies may persist for varying periods depending on their purpose.

---

Section 8. Analytics and Performance Cookies

8.1 Analytics cookies collect information about how you use the Services to help us understand usage patterns, identify issues, and improve the user experience.

8.2 Analytics cookies may collect: pages visited, time spent, links clicked, scroll depth, errors, device/browser information, approximate location, referral source, and navigation patterns.

8.3 Analytics cookies are not intended to collect the substantive content of your Workflows, prompts, Outputs, User Secrets, or credentials. Diagnostics may include limited technical context. If we associate analytics data with your Account for logged-in users, it is for usage understanding, not advertising.

8.4 Analytics cookies sit in the Analytics category on our banner and are off by default. Analytics scripts, including Google Analytics, are loaded only after you enable the Analytics category; if you reject optional cookies, or take no action, no analytics technology is loaded and no analytics cookie is set. To change a choice you have already made, see Section 16.2. You may also block analytics through browser settings or third-party opt-out mechanisms.

8.5 If enabled, we may use third-party analytics providers. These providers may place their own cookies and may act as independent controllers for their own processing purposes where enabled. Their processing is subject to their own privacy policies. The specific configuration (including IP anonymization and data retention) may vary and is subject to change.

8.6 Analytics data may be aggregated and de-identified for reports that do not identify individuals.

---

Section 9. Marketing, Advertising, and Social Media

9.1 NodeFox does not currently use marketing, advertising, or targeting cookies. We do not currently display third-party advertisements, track you across other websites for advertising, share cookie data with advertising networks, use retargeting cookies, or build advertising profiles.

9.2 We do not currently engage in cross-context behavioral advertising as defined by the CCPA.

9.3 If we introduce marketing cookies in the future, we will update this Policy and obtain consent where required.

9.4 Social Media. The Services may include links to social media profiles or, in limited cases, embedded social features. If you interact with social media features, the platform may set its own cookies under its own privacy policy. Some platforms may set cookies passively when a page loads, even without interaction. This is outside our control. Where possible, we use static links rather than embedded widgets.

9.5 If a user embeds a third-party widget (such as a video or external content) inside a shared Workspace or Marketplace documentation, NodeFox does not control cookies deployed by that user-generated embed.

---

Section 10. Detailed Cookie Inventory

10.1 This inventory is representative, not exhaustive. The tables below list cookies and storage keys that may be used across the Services as of the Last Updated date. They are representative examples: not every entry is set on every page or in every deployment, some are set only by third parties on their own hosted pages, and as we update infrastructure specific names may change, though the category and functional purpose will remain consistent. The entries marked Confirmed are the ones the NodeFox website sets today. Because NodeFox does not yet operate a preference center, this Policy — not a preference center — is the controlling description of our cookie use.

Essential (strictly necessary):

Personalization (functional):

Analytics — set only when you enable the Analytics category:

Google Analytics is being onboarded. Where it is in use, the Google Analytics script is loaded only after the Analytics category is enabled; it is not loaded, and none of the _ga/_gid/_gat cookies are set, if you reject optional cookies or make no choice.

---

Section 11. Third-Party Cookies

11.1 We limit third-party cookies to essential services and those you consent to where required. Third parties control their own cookie names, values, durations, and processing.

11.2 We utilize third-party service providers for hosting, authentication, security, payments, and analytics. For the current list of infrastructure providers, their purposes, and links to their privacy policies, see our Subprocessor List.

11.3 You may opt out of third-party cookies through their own mechanisms, browser settings, or privacy extensions.

11.4 Headless API and Webhook Access. When the Services are accessed programmatically via APIs or inbound webhooks configured by a Customer, those requests are server-to-server and our cookie banner does not apply to them. Rate limiting and abuse prevention for such requests are performed server-side (see Section 14.9), not by setting cookies on the caller.

11.5 Embedded Third-Party Content. Embedded third-party content (social embeds, hosted video, documentation, fonts, user-generated iframes) may set cookies or similar identifiers. NodeFox does not control those cookies and is not responsible for third-party tracking through embedded content.

---

Section 12. Cookies on the Website and in the Application

12.1 Public Website. When you visit public pages, we may set strictly necessary cookies for security and functionality, functional cookies to remember preferences (with consent where required), and analytics cookies (with consent where required).

12.2 Logged-In Experience. Additional cookies for authentication, security verification, and personalization.

12.3 Cookie Banner. We display a cookie banner to every visitor on first visit, not only where law requires one. It lets you accept all cookies, reject optional cookies, or manage the categories individually. See Section 16.

12.4 Desktop Application. The Desktop Application stores authentication tokens in your operating system's secure credential storage (not browser cookies), local preferences, and telemetry data per your settings. When the Application opens web-based features (authentication flows, embedded webviews), standard web cookies may apply.

---

Section 13. Cookies in Emails

13.1 Our marketing emails may contain tracking technologies (tracking pixels/web beacons) that indicate whether you opened the email. Email tracking is used only where lawful. Transactional/service emails may contain minimal tracking where permitted by law.

13.2 Email tracking may collect: whether and when you opened the email, approximate location, and device/email client.

13.3 Enterprise email security gateways (such as Proofpoint, Mimecast, or similar scanners) may automatically pre-fetch tracking pixels, resulting in an "opened" status even if you have not personally viewed the email.

13.4 Unsubscribe from marketing emails via the unsubscribe link. Transactional emails cannot be unsubscribed while you maintain an active Account. Disable image loading in your email client to prevent pixel tracking (may affect display).

---

Section 14. Local Storage and Similar Technologies

14.1 HTML5 Local Storage. We may use local storage (larger than cookies, does not expire automatically, not sent with HTTP requests) for caching, application state, offline functionality, and preferences. Clear via browser developer tools or settings.

14.2 Session Storage. Similar to local storage but cleared when you close the tab/window. Used for temporary session state and form data.

14.3 IndexedDB and OPFS. IndexedDB is a browser database storing larger amounts of structured data. It is fundamental to the Services' local-first WASM architecture. IndexedDB data persists until you clear it or until browser storage cleanup mechanisms remove it. Standard "Clear Cookies" commands in some browsers do not automatically clear IndexedDB or OPFS data. Complete removal may require explicitly selecting "Clear Site Data" or using browser developer tools.

14.4 Browser Storage Eviction. HTML5 local storage, OPFS, and IndexedDB are subject to storage quotas and automated eviction policies enforced by your browser or operating system. If your device's disk space is low, your browser may permanently and silently delete local databases. NodeFox is not liable for loss of local data caused by browser storage eviction.

14.5 Service Workers and Cache Storage. The Services may register browser Service Workers and utilize Cache Storage for offline functionality and performance. Standard "Clear Cookies" commands may not automatically unregister Service Workers or clear PWA caches. Full removal may require manually unregistering Service Workers via browser developer tools.

14.6 Fingerprinting. NodeFox does not use browser fingerprinting for tracking or advertising profiling and does not create persistent fingerprint identifiers. We use limited device and network signals (IP address, user-agent, session tokens) for security, fraud prevention, and rate limiting where technically necessary. For the pre-signup demo on our website we store a hashed form of the visitor's IP address to enforce usage limits; the hash is not used to build a profile or to track you across sites.

14.7 Payment Security Telemetry. During checkout and billing, payment processors (e.g., Stripe) may utilize advanced device fingerprinting and behavioral telemetry strictly for fraud risk scoring and anti-money laundering compliance. This is classified as strictly necessary security and operates independently of cookie consent preferences.

14.8 Marketplace Component Storage. Third-party Marketplace Content (custom nodes, templates) may execute JavaScript that reads, writes, or injects cookies, local storage, or IndexedDB entries. NodeFox disclaims liability for unauthorized tracking, storage use, or data collection by third-party Marketplace components. You are responsible for auditing code of community components you execute.

14.9 Server-Side Equivalents. Certain purposes served by cookies (fraud detection, rate limiting, security logging, abuse prevention) may also be implemented server-side using IP addresses, hashed IP addresses, user-agent strings, session tokens, and request headers, regardless of your cookie preference settings. Netlify Edge Functions also perform an authentication and session check for the application, which involves reading your IP address and session cookie on the server. Opting out of non-essential cookies does not disable server-side security measures.

---

Section 15. Your Cookie Choices

15.1 You have several options: the cookie banner shown on your first visit, your browser settings, third-party opt-out mechanisms, and emailing privacy@nodefox.ai. NodeFox does not currently operate a cookie preference center in account settings, and does not currently process Global Privacy Control signals (Section 17.2).

15.2 We do not condition access to the Services on acceptance of non-essential cookies. However, strictly necessary cookies and local storage are required for core functionality; blocking them via your browser may impair or prevent use of the Services.

15.3 Browser Settings. Most browsers allow you to block, delete, and manage cookies. Consult your browser's documentation for instructions. Private/incognito mode limits cookie persistence but does not prevent cookies during the session.

15.4 Strict Browser Interference. Privacy-focused browsers (e.g., Brave, Safari ITP) and aggressive ad-blocking extensions may classify strictly necessary cross-subdomain authentication tokens as "third-party trackers," causing login failures or redirect loops. NodeFox is not liable for service degradation caused by your browser blocking strictly necessary authentication cookies. You may need to whitelist nodefox.ai domains.

15.5 Embedded Context Degradation. If you embed NodeFox interfaces or forms into external websites (e.g., via iframes), browser privacy engines may block NodeFox's authentication cookies as cross-site trackers, causing embedded elements to fail. NodeFox is not responsible for degradation in embedded contexts caused by third-party cookie restrictions.

15.6 Shared Devices. Cookie preferences are saved at the browser profile level, not the NodeFox Account level. On shared devices or shared browser profiles, consent preferences set by other users apply to your session. NodeFox is not liable for tracking resulting from inherited consent settings on shared hardware.

---

Section 16. Cookie Consent Management

16.1 The Banner. On your first visit we display a cookie banner explaining our use of cookies and offering three actions — Accept all, Reject optional, and Manage preferences — plus a link to this Policy. "Manage preferences" opens the three categories (Essential, which cannot be changed; Analytics; Personalization) so you can enable each one individually and save. Analytics and Personalization are off unless you turn them on.

16.2 Changing a Choice You Have Already Made. NodeFox does not currently offer a cookie preference center in account settings, and there is no "Cookie Settings" link in the website footer. To change your choice today you can:

• clear the nodefox_cookie_consent cookie and NodeFox site data in your browser (which also clears the nodefox_cookie_consent_v2 local-storage record) and reload the site, at which point the banner appears again and you can choose afresh;
• change or block cookies in your browser settings; or
• email privacy@nodefox.ai and tell us the categories you want set, and we will act on your request.

We intend to add a preference center and a persistent footer link. We will update this Section when we do; until then, treat the three methods above as the complete list.

16.3 Your preferences are stored in a first-party cookie (nodefox_cookie_consent, one year) and mirrored in browser local storage (nodefox_cookie_consent_v2). Preferences are per browser profile, not per NodeFox account. Clearing cookies and site data will prompt you again.

16.4 Consent Records. We may retain consent logs (timestamp, region, preferences selected, device/browser signals) for compliance and auditing purposes. Consent records may be retained longer than cookie lifetimes.

---

Section 17. Do Not Track and Opt-Out Preference Signals

17.1 Do Not Track. There is no universally accepted standard for DNT signals. We do not currently change practices based on DNT signals. DNT does not override the choices you make on our cookie banner.

17.2 Global Privacy Control. NodeFox does not sell or share personal information as those terms are defined by the CCPA, so no opt-out preference signal is required. NodeFox does not currently process Global Privacy Control (GPC) signals. If NodeFox ever begins selling or sharing personal information, we will implement a mechanism that recognizes GPC and will update this Policy before doing so. Sending a GPC signal does not change the cookie categories you have enabled on our banner; use the methods in Section 16.2 for that.

---

Section 18. Regional Cookie Consent

18.1 EEA/UK/Switzerland. Where the ePrivacy Directive, GDPR, or UK GDPR applies, we obtain consent before placing non-essential cookies. Our consent mechanism is designed to be freely given (for non-essential cookies), specific, informed, and based on affirmative action, to the extent required by applicable law. Where required, non-essential cookies are not set before consent is obtained. You may withdraw consent at any time by the methods in Section 16.2 (clearing the consent cookie and site data, browser settings, or emailing privacy@nodefox.ai).

18.2 California. We do not sell personal information collected through cookies. We do not share personal information collected through cookies for cross-context behavioral advertising. We do not intentionally collect sensitive personal information through cookies. Because we do not sell or share personal information, no opt-out preference signal is required and no "Do Not Sell or Share My Personal Information" link is required; NodeFox does not currently process GPC signals (Section 17.2).

18.3 Other Jurisdictions. We obtain consent and follow applicable cookie requirements as required by applicable law. Our default approach for jurisdictions without specific cookie consent requirements is transparency through this Policy, cookies for legitimate purposes, data minimization, and no advertising cookies.

---

Section 19. Children and Cookies

19.1 The Services are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where required by applicable law). We do not target cookies to children.

19.2 If we learn we have collected data from a child below the applicable age threshold, we will take appropriate steps as required by law.

---

Section 20. Data Collected Through Cookies

20.1 Data collected through cookies and similar technologies may include: technical data (IP address, browser, OS, device, screen resolution, language); usage data (pages visited, time spent, links clicked, features used, referral source); preference data (language, theme, display settings); session data (session ID, auth state, navigation); and analytics data (aggregated usage, traffic, user flows).

20.2 We do not intentionally collect through cookies the substantive content of Workflows, prompts, or Outputs; User Secrets or credentials; or sensitive personal information (except via payment processor security on checkout pages). Third-party embeds and analytics may incidentally capture additional technical context.

---

Section 21. How We Use Cookie Data

21.1 We use cookie data for: essential operations (authentication, sessions, security, core functionality); personalization (preferences, customization); analytics (usage understanding, performance measurement, issue identification); and security and abuse prevention (fraud detection, bot prevention, rate limiting, account protection).

21.2 We do not currently use cookie data for advertising, building advertising profiles, cross-context behavioral advertising, or selling to third parties.

---

Section 22. Sharing and Retention

22.1 Sharing. We share cookie data only with: service providers operating on our behalf under contract; as required by law; and in connection with business transfers. We do not sell cookie data. Third-party analytics providers receive data directly through their cookies when enabled and may act as independent controllers under their own policies.

22.2 Retention. Session cookies are deleted when you close your browser. Persistent cookies are deleted at expiration or when you delete them. Server-side logs derived from cookie events are retained per our Privacy Policy and may persist longer in aggregated/de-identified form.

22.3 Deletion. Delete cookies at any time via browser settings. This may log you out and reset preferences.

---

Section 23. Security

23.1 We implement security measures appropriate to the beta nature, scale, and risk profile of the Services. Cookies have inherent security limitations (transmitted with HTTP requests, stored on your device, potentially accessible to malware). No security measure constitutes a warranty or guarantee.

23.2 You are responsible for keeping your browser and device secure, using secure networks, and protecting against malware.

---

Section 24. Cross-Device Tracking

24.1 NodeFox does not currently engage in cross-device tracking for advertising purposes and does not currently build cross-device advertising profiles.

24.2 If you are logged into your Account on multiple devices, we may associate activity across devices for providing a consistent experience, syncing preferences, synchronizing Workflow states and live updates via WebSockets or real-time listeners, and security monitoring. This is account-linked activity, not fingerprinting-based cross-device tracking.

---

Section 25. Third-Party Websites

25.1 The Services may link to third-party websites. This Policy does not apply to those sites. We encourage you to review their privacy and cookie policies. Links do not imply endorsement.

---

Section 26. Updates to This Policy

26.1 We may update this Policy to reflect changes in practices, technology, or law. We may provide notice by posting with a new "Last Updated" date, displaying a notice, or updating the cookie banner.

26.2 Continued use after changes constitutes acknowledgment of the updated Policy. This acknowledgment is not cookie consent for opt-in jurisdictions; consent continues to be managed via the cookie banner, and changed by the methods in Section 16.2.

26.3 Prior versions may be available upon request.

---

Section 27. Contact

Mailing Address (send all correspondence here): NodeFox LLC, PO Box 1667, Ross, CA 94957, United States

Principal Place of Business (no mail delivery): NodeFox LLC, a California limited liability company, 2108 N St, Suite N, Sacramento, CA 95816, United States

EU Representative: Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23 AT2P, Ireland. gdpr@euverify.com

UK Representative: Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom. gdpr@euverify.com

NodeFox does not guarantee response times unless expressly agreed in writing.

---

Cookie Quick Reference

Third-party opt-out tools are provided by the respective third parties and may change; availability is not guaranteed by NodeFox.

---

© 2025–2026 NodeFox LLC. All rights reserved.