Cookie Policy
Last updated: 15 September 2026
The short version
Nexa Sentry sets one cookie, and it exists only to keep you signed in. We run no analytics, no advertising pixels, no session recording and no cross-site trackers.
What is actually stored
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
soc_token | Cookie (HTTP-only) | Your signed-in session. Without it you cannot stay logged in. | Until it expires or you sign out |
soc-theme | Local storage | Remembers whether you chose the light or dark theme. | Until you clear your browser data |
pending2fa | Session storage | Carries the short-lived token between the sign-in form and the two-factor step. | Cleared as soon as the step finishes, and when the tab closes |
| Pinned navigation | Local storage | Remembers which sidebar links you pinned. | Until you clear your browser data |
None of these are shared with anyone. The last three never leave your browser — they are not sent to our servers at all.
Why there is no consent banner
Under the EU ePrivacy Directive and the UK PECR, consent is required before storing anything on a visitor’s device except what is strictly necessary to deliver a service the user has explicitly requested. A session cookie that keeps you logged in is the textbook example of a strictly necessary cookie, and a remembered theme or pinned link is a preference you set yourself.
Because we set nothing for analytics, advertising or measurement, there is nothing here that needs consent, and a banner asking for it would be asking about a choice that does not exist. This stops being true the moment any analytics or advertising tool is added — at that point a compliant consent mechanism, with the ability to refuse as easily as to accept, becomes mandatory.
One thing that is not a cookie, but is a transfer
The site loads its typefaces from Google Fonts. Your browser therefore requests those font files from Google’s servers, which discloses your IP address to Google on every page load. This stores nothing on your device, so it is not a cookie question — but it is a transfer of personal data to a third party, and courts in the EU have treated embedding Google Fonts this way as a privacy infringement. Serving the fonts from our own domain instead would remove the transfer entirely. See the Privacy Policy for the full list of recipients.
Controlling what is stored
Every browser lets you view and delete cookies and site data. Deleting soc_token signs you out; deleting the rest simply resets your theme and pinned links. Blocking cookies entirely will prevent you from signing in, because there is no other way for the Service to recognise your session.
Questions
Email [email protected].