Cookie Policy

This page lists exactly what Nesta stores in your browser today — not a generic list of cookie categories that may or may not apply.

What we set

• Session cookie (authjs.session-token, or __Secure-authjs.session-token in production) — keeps you signed in. It is strictly necessary: without it, the site cannot tell you're logged in between page loads. It is HTTP-only (invisible to page JavaScript), sent only over HTTPS in production, and expires automatically. There is no way to use Nesta while signed in without this cookie.
• CSRF protection cookie — set by our authentication library alongside the session cookie to prevent cross-site request forgery on sign-in.

What we don't set

Nesta does not run third-party analytics, advertising, or tracking scripts, and does not set any cookie for those purposes. If that changes in the future, this page will be updated to name the specific service and cookie before it goes live.

Local storage

Some pages may use your browser's local storage (not a cookie, and never sent to our servers automatically) for small conveniences like remembering a UI preference. This is not used for tracking.

Managing cookies

Because the session cookie is required for sign-in to function, there is no in-app cookie-preferences control to turn it off selectively — you can block or delete it using your browser's own settings, which will simply sign you out.