Cookie Policy - NS Analytics Web App

---

1. Introduction

NS Analytics ("we," "us," or "our"), operated by Caskfive LLC, uses cookies and similar tracking technologies on the NS Analytics web application at analytics.networksurvey.app (the "Service").

This Cookie Policy explains what cookies are, how we use them, what types of cookies we use, and how you can control your cookie preferences.

This Cookie Policy should be read together with our:

• Privacy Policy - How we collect and use personal data
• Terms of Service - Terms governing use of the Service

By using the Service, you consent to our use of cookies in accordance with this Cookie Policy.

---

2. What Are Cookies

2.1 Definition

Cookies are small text files that are placed on your computer or mobile device when you visit a website. Cookies are widely used to make websites work more efficiently and to provide information to website owners.

2.2 How Cookies Work

When you visit a website, the website sends a cookie to your browser. Your browser stores the cookie and sends it back to the website on subsequent visits. This allows the website to recognize your browser and remember information about your visit.

2.3 Tracking Technologies Covered

This Cookie Policy covers all tracking technologies that store or access information on your device, including:

• HTTP cookies (session and persistent)
• Flash cookies (Local Shared Objects)
• Web beacons (tracking pixels, clear GIFs)
• Local storage (HTML5 localStorage, sessionStorage)
• IndexedDB (browser databases)
• Device fingerprinting techniques
• Similar tracking technologies

For simplicity, we refer to all of these as "cookies" in this policy.

---

3. Why We Use Cookies

We use cookies for the following purposes:

3.1 Essential Service Operation

• Authentication: To keep you logged in as you navigate the Service
• Security: To protect against fraudulent activity and enhance security
• Session management: To remember your session state and preferences during a visit
• Load balancing: To distribute requests efficiently across our servers

3.2 Functionality and Preferences

• User preferences: To remember your settings, language, and customizations
• Service functionality: To enable features like map layers, time ranges, and filters

3.3 Analytics and Performance

• Usage analytics: To understand how visitors use the Service
• Performance monitoring: To identify and fix performance issues
• Feature usage: To understand which features are most valuable

3.4 Legal Compliance

• Beta access enforcement: To verify access authorization during beta period
• Consent tracking: To record and honor your cookie preferences

---

4. Types of Cookies We Use

We categorize cookies based on their purpose and whether they require your consent under GDPR and ePrivacy Directive.

4.1 Strictly Necessary Cookies

Consent Required: NO (essential for service operation)

These cookies are essential for the Service to function and cannot be switched off. Without these cookies, core features like login and session management would not work.

4.2 Functional Cookies

Consent Required: YES (under GDPR/ePrivacy)

These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings. The Service can function without these cookies, but with reduced convenience.

4.3 Analytics/Performance Cookies

Consent Required: YES (under GDPR/ePrivacy)

These cookies collect information about how you use the Service (pages visited, features used, errors encountered). This helps us improve the Service but is not strictly necessary for operation.

4.4 Marketing/Advertising Cookies

Consent Required: YES (under GDPR/ePrivacy)

We do not currently use marketing or advertising cookies. We do not track you across other websites or serve targeted advertisements.

---

5. Cookie Details

5.1 Strictly Necessary Cookies

Firebase Authentication Cookies

Cookie Name	Provider	Purpose	Duration
__session	Firebase (Google)	Authenticates your identity and maintains login session	Session
__Secure-*	Firebase (Google)	Secure authentication tokens	Varies

Additional Information:

• Firebase Authentication may also store authentication state in IndexedDB (browser database)
• These cookies are essential for logging in and accessing your account
• Data is processed by Google LLC in the United States
• Firebase Privacy Policy

Beta Access Cookie

Cookie Name	Provider	Purpose	Duration
beta_access_validated	NS Analytics (Caskfive LLC)	Verifies access authorization during beta period	1 year

Additional Information:

• Required to access the Service during beta testing period
• Signed with cryptographic signature to prevent tampering
• httpOnly flag prevents JavaScript access (security measure)
• Secure flag ensures transmission only over HTTPS

Notification Cookies

Cookie Name	Provider	Purpose	Duration
deletion_canceled	NS Analytics (Caskfive LLC)	Displays one-time notification when account deletion is canceled	Temporary

Additional Information:

• Set by backend when you cancel an account deletion request
• Immediately deleted by frontend after displaying notification
• No persistent tracking or data collection

---

5.2 Analytics/Performance Cookies (Require Consent)

Firebase Analytics / Google Analytics Cookies

Cookie Name	Provider	Purpose	Duration
_ga	Google Analytics (via Firebase)	Distinguishes unique users for analytics	2 years
_ga_<container-id>	Google Analytics (via Firebase)	Stores session and campaign data	2 years
_gid	Google Analytics (via Firebase)	Distinguishes users for 24-hour period	24 hours
_gat	Google Analytics (via Firebase)	Throttles request rate to analytics servers	1 minute

Additional Information:

• Only active in production (not in development environment)
• These analytics cookies track usage of the NS Analytics web application to help us improve features and user experience
• Used to track page views, user flows, and feature usage
• Helps us understand which features are most valuable and where users encounter issues
• Data is processed by Google LLC in the United States
• You can opt out via browser settings or our cookie consent banner
• Google Analytics Privacy Policy
• Google Analytics Opt-Out Browser Add-on

Data Collected:

• Pages visited and time spent
• Referral source (how you found NS Analytics)
• Browser type and version
• Operating system
• Screen resolution
• General geographic location (city/region, not precise location)
• User interactions (clicks, feature usage)

---

5.3 Functional Cookies (Require Consent)

Mapbox Cookies

Cookie Name	Provider	Purpose	Duration
Various (TBD)	Mapbox Inc.	Map tile caching, performance optimization	Varies

Additional Information:

• Used for rendering map visualizations
• May cache map tiles for performance
• Exact cookie names and durations require browser testing (we will update this policy with specific details)
• Data may be processed in the United States and globally via CDN
• Mapbox Privacy Policy
• Mapbox Cookie Policy

---

5.4 Payment Processing Cookies (Contextual)

Stripe Cookies

Cookie Name	Provider	Purpose	Duration
__stripe_mid	Stripe Inc.	Fraud detection and prevention	1 year
__stripe_sid	Stripe Inc.	Fraud detection for active session	30 minutes

Additional Information:

• Only set when you initiate payment or visit Stripe checkout (not set during normal browsing)
• Required for secure payment processing and fraud prevention
• Classified as "functional" for payment processing purposes
• Data is processed by Stripe Inc. in the United States
• Stripe Privacy Policy
• Stripe Cookie Policy

---

6. Third-Party Cookies

6.1 Third Parties We Work With

We use the following third-party service providers that may set cookies:

Provider	Purpose	Privacy Policy
Google (Firebase)	Authentication, Analytics	Link
Stripe	Payment Processing	Link
Mapbox	Map Visualization	Link

6.2 Third-Party Data Processing

When third parties set cookies through our Service:

• They process data as our service providers (data processors) under contractual obligations
• They are required to protect your data and use it only to provide services to us
• They may transfer data internationally (see Section 6.3)
• You can review their privacy policies to understand their practices

6.3 International Data Transfers

Firebase/Google: Data may be processed in the United States and other Google data center locations. Firebase Authentication data is processed exclusively in U.S. data centers. Google participates in the EU-U.S. Data Privacy Framework.

Stripe: Data may be processed in the United States and globally through Stripe's payment network. Stripe participates in the EU-U.S. Data Privacy Framework.

Mapbox: Data may be processed in the United States and globally via content delivery networks (CDNs).

Legal Basis: Transfers to the United States are covered by:

• EU-U.S. Data Privacy Framework certifications (where applicable)
• Standard Contractual Clauses (SCCs)
• Service provider agreements with data protection obligations

6.4 Third-Party Changes

We are not responsible for changes to third-party cookies, policies, or practices. Third parties may add, remove, or modify cookies without our knowledge. We will make reasonable efforts to update this Cookie Policy when we become aware of changes.

---

7. How to Manage Cookies

You have several options to control and manage cookies:

7.1 Cookie Consent Banner

When you first visit NS Analytics, you will see a cookie consent banner with the following options:

• Accept All: Consent to all cookies (essential, functional, analytics)
• Reject All: Decline non-essential cookies (only strictly necessary cookies will be set)
• Customize: Choose which categories of cookies to accept (granular control)

To change your preferences later:

1. Click "Cookie Settings" in the website footer
2. Use the "Cookie Preferences" option in Account Settings (if logged in)
3. Clear your cookies and revisit the site to see the banner again

7.2 Browser Settings

Most browsers allow you to:

• View cookies stored by websites
• Delete all or specific cookies
• Block all cookies
• Block third-party cookies only
• Receive warnings before cookies are set

Browser-Specific Instructions:

• Chrome: Settings > Privacy and Security > Cookies and other site data (Help)
• Firefox: Settings > Privacy & Security > Cookies and Site Data (Help)
• Safari: Preferences > Privacy > Cookies and website data (Help)
• Edge: Settings > Cookies and site permissions (Help)

7.3 Opt-Out Tools

Google Analytics Opt-Out: Install the Google Analytics Opt-Out Browser Add-on to prevent Google Analytics from collecting data across all websites (not just NS Analytics).

Global Privacy Control (GPC): We honor Global Privacy Control signals from your browser. If your browser sends a GPC signal, we will treat it as a request to opt out of analytics cookies.

7.4 Do Not Track (DNT)

Do Not Track is a browser setting that requests websites not to track you. There is currently no industry consensus on how to respond to DNT signals.

Our approach: We do not currently respond to DNT signals as a standalone mechanism. Instead, we rely on:

• Cookie consent banner (explicit opt-in for EU/UK users)
• Global Privacy Control (GPC) signals (honored for all users)
• Browser cookie settings (always respected)

---

8. Cookie Consent

8.1 EU/UK Users (GDPR and ePrivacy Directive)

Consent requirement: We are required by law to obtain your consent before setting non-essential cookies.

Our implementation:

• Strictly necessary cookies: Set automatically without consent (legal exception)
• All other cookies: Only set after you provide explicit consent via the cookie banner

Your consent is:

• Freely given: You can reject cookies and still access the Service (though some features may not work)
• Specific: You can accept or reject individual categories of cookies
• Informed: This Cookie Policy provides detailed information about each cookie
• Unambiguous: Requires affirmative action (clicking "Accept" or selecting categories)
• Easily withdrawn: You can change your preferences at any time via Cookie Settings

Cookie blocking: We technically block non-essential cookies until you consent. Simply showing a banner while setting cookies would violate the law.

8.2 California Users (CCPA/CPRA)

Under California law, cookies that enable data sharing with third parties trigger disclosure and opt-out requirements.

Our practices:

• We share data with third-party service providers (Firebase, Stripe, Mapbox) to provide the Service
• These providers process data on our behalf under contracts that restrict their use of the data
• We do not "sell" data as defined by CCPA

Your rights:

• Do Not Sell or Share My Personal Information: We do not sell personal information. However, analytics cookies may constitute "sharing" for advertising purposes under CPRA. You can opt out of analytics cookies via our cookie banner.
• Limit Use of Sensitive Personal Information: If you upload precise location data, you can limit its use via data deletion or restricting uploads.

8.3 Consent Records

When you provide or withdraw consent, we record:

• Timestamp of consent/withdrawal
• Version of Cookie Policy you consented to
• Categories of cookies you accepted or rejected
• Method of consent (e.g., "Accept All" button clicked)

These records are maintained for compliance purposes and may be required by regulators.

---

9. Local Storage and Session Storage

In addition to cookies, we use browser storage mechanisms to store data locally on your device.

9.1 Local Storage (HTML5 localStorage)

Data stored:

• selectedWorkspaceId - Your currently selected workspace ID
• customHierarchyPresets - Custom map layer hierarchy configurations
• timeRange - Your selected time range preferences for analytics

Purpose: To remember your preferences across sessions without requiring cookies

Persistence: Data persists until you clear browser data or we delete it programmatically

Privacy: Local storage data is not transmitted to our servers automatically (only when you explicitly take actions like changing workspace)

9.2 Session Storage (HTML5 sessionStorage)

Data stored:

• mapReturnTo - Navigation state for returning from map view
• mapState - Temporary map view state (zoom, center, filters)

Purpose: To maintain session-specific UI state

Persistence: Data is cleared when you close the browser tab/window

Privacy: Session storage data is not transmitted to our servers

9.3 IndexedDB

Firebase Authentication may use IndexedDB (a browser database) to store authentication state and tokens locally. This enables offline authentication and faster login.

Purpose: To maintain authentication state and enable offline access

Persistence: Until you log out or clear browser data

Privacy: Contains authentication tokens but is not directly accessible to JavaScript code (protected by Firebase SDK)

9.4 Managing Browser Storage

To clear local storage, session storage, and IndexedDB:

• Chrome: Settings > Privacy and Security > Clear browsing data > Cookies and other site data
• Firefox: Settings > Privacy & Security > Clear Data > Cookies and Site Data
• Safari: Develop > Empty Caches (enable Develop menu in Preferences)
• Edge: Settings > Privacy > Clear browsing data > Cookies and other site data

Impact of clearing storage:

• You will be logged out
• Your preferences (workspace, time range, custom presets) will be reset to defaults
• Map state will be lost
• You will need to re-configure settings

---

10. Changes to This Policy

10.1 Updates

We may update this Cookie Policy from time to time to reflect:

• Changes to cookies we use (adding or removing cookies)
• Changes in cookie regulations or best practices
• Changes to third-party service providers
• Updates to cookie duration or purposes

10.2 Notification

When we make material changes to this Cookie Policy, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email if the changes significantly affect your rights
• Request renewed consent if required by law (e.g., adding new cookie categories)

10.3 Your Responsibility

You are responsible for regularly reviewing this Cookie Policy. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

---

11. Contact Us

11.1 Cookie Questions

If you have questions about this Cookie Policy or how we use cookies, contact us at:

Email: support@caskfive.com (with subject "Cookie Policy Question")

11.2 Privacy and Data Protection

For broader privacy questions or to exercise your data protection rights (GDPR, CCPA), see our Privacy Policy or contact:

Email: support@caskfive.com (with subject "Privacy Request")

11.3 Regulatory Complaints

If you are located in the EU/UK and are unsatisfied with our response to your cookie-related concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

U.S. Users: You may contact your state attorney general or the Federal Trade Commission.

---

Summary Table: All Cookies at a Glance

Cookie	Provider	Category	Consent	Duration	Purpose
__session	Firebase	Necessary	No	Session	Authentication
__Secure-*	Firebase	Necessary	No	Varies	Secure auth tokens
beta_access_validated	NS Analytics	Necessary	No	1 year	Beta access verification
deletion_canceled	NS Analytics	Necessary	No	Temporary	Deletion notification
_ga	Google Analytics	Analytics	Yes	2 years	User identification
_ga_<id>	Google Analytics	Analytics	Yes	2 years	Session data
_gid	Google Analytics	Analytics	Yes	24 hours	User identification (daily)
_gat	Google Analytics	Analytics	Yes	1 minute	Request throttling
Mapbox (TBD)	Mapbox	Functional	Yes	Varies	Map tile caching
__stripe_mid	Stripe	Functional	Contextual	1 year	Payment fraud detection
__stripe_sid	Stripe	Functional	Contextual	30 minutes	Session fraud detection

---

Effective Date: November 18, 2025
Caskfive LLC
NS Analytics
analytics.networksurvey.app