On this page
1. What this policy covers
This policy lists the cookies and the browser storage that Noda uses, what each one is for and how long it lasts. TIMPIA S.R.L. runs Noda (details on the company page). Questions go to hello@noda.energy.
The websites noda.energy and trust.noda.energy set no cookies and run no analytics. On noda.energy, the prompt you are typing, and a file you attach to it, stay in your browser until you send it or close the tab, so a reload does not lose them. noda.energy also reads the noda_signed_in cookie to show the right button. Everything else below is about the app at app.noda.energy.
2. Cookies the app needs
These cookies keep you signed in and protect the service. The app cannot work without them, so they need no consent (Article 4(5) of Romanian Law 506/2004). They are all Secure. Each is set only for the address that uses it, app.noda.energy or, for staff, admin.noda.energy, except noda_signed_in.
| Cookie | What it does | How long |
|---|---|---|
noda_access | Proves that you are signed in. Scripts on the page cannot read it. | 30 minutes, renewed by noda_refresh |
noda_refresh | Renews noda_access, so you stay signed in. Scripts cannot read it. | 30 days |
noda_session | Tells the app that a signed-in session exists. | 30 days |
noda_signed_in | Tells noda.energy that you are signed in to the app. Set for all of noda.energy. | 30 days |
noda_did | A signed browser ID that limits the free prompts of guests and shared chats. Set when you send a prompt as a guest or open a shared chat. | 400 days |
__Host-noda_sso | Ties a single sign-on attempt to your browser. | 10 minutes |
noda_int_oauth_<provider> | Protects the step where you connect an integration, such as a cloud drive. | 10 minutes |
noda_admin_session | Noda staff only, on admin.noda.energy. | 12 hours |
3. Analytics, only if you agree
If you agree, the app uses PostHog, hosted in the EU, to see how people use it: which pages and buttons they use and where they get stuck. PostHog then sets the cookie ph_<key>_posthog for noda.energy, for up to one year, and keeps a copy in local storage. It is linked to your account, your role, your plan and your company. It does not record your screen and keeps no text from the page, so your chats and files are not part of it.
The app asks once, after you sign in. Until you choose Allow, PostHog does not load and sets nothing. PostHog never runs for guests. You can change your choice at any time in Settings > Privacy > Product analytics. When you turn it off, PostHog stops and its cookie is removed from your browser. Our legal basis is your consent (Article 6(1)(a) GDPR). Withdrawing it does not affect what was collected before.
4. Browser storage
The app also keeps data in your browser's local storage, session storage and IndexedDB, for its own working:
- signing in and coming back to where you were, for example the page to open after sign-in or a guest prompt to keep after sign-up;
- a copy of what the app already showed you, so pages open fast. It holds no password and no sign-in token;
- your layout and map choices, such as the sidebar, the base map and the layers you turned on, and what you have already read, such as What's new and notifications;
- the campaign tags of the link that brought you to Noda (for example utm_source), so we know which of our campaigns work;
- a browser ID for the guest free-prompt check. When you send a prompt as a guest, FingerprintJS also runs in your browser to make a device signal. The Privacy Policy says how we keep only keyed hashes of it.
Signing out deletes this data from that browser, except your theme, how you last signed in, your analytics choice, the guest browser ID and a few one-time hints.
5. Services that load in your browser
- Google. On the sign-in and sign-up pages, Google's sign-in button loads from accounts.google.com, and Google may use its own cookies there under its own policy. If you connect Google Drive, Google's file picker loads the first time you open it. The small source icons next to an answer come from Google's icon service, which receives your IP address. A page that Noda AI builds in a chat can load its fonts from Google Fonts.
- Mapbox. It draws the maps. Mapbox GL keeps an ID in local storage and reports each map load to Mapbox, which counts them to bill us. We have turned off its performance metrics.
- Sentry. It reports errors in the app through our own server, with personal data turned off. It sets no cookie.
- Stripe. You pay on Stripe's own checkout page, which uses its own cookies under Stripe's policy. The app loads no Stripe script.
The Trust Center lists every company that handles data for Noda and where it is.
6. How to control cookies
Your browser can block or delete cookies, for all sites or for noda.energy. If you block the cookies in section 2, you cannot sign in. The analytics choice is in Settings > Privacy > Product analytics.
7. Changes to this policy
We update this page when the app's cookies change. The date at the top shows the version in force.