Cookie Policy

1. The short version

• We use Google Analytics 4 (GA4) on nestsheet.com to understand traffic and — with your consent — for remarketing.
• The banner's default is denied: ignore it or decline, and your device stays free of analytics cookies.
• Declining does not make you invisible to us entirely: Google's tag still sends anonymous, cookieless signals used for aggregate estimates. Section 4 explains this honestly.
• Accepting sets the _ga cookies listed in section 3 and switches on analytics and advertising features.
• Your choice is remembered in your browser for 12 months and can be changed any time via Cookie settings in the footer.
• Signing in to the builder stores a token in localStorage, not in a cookie. Paddle's checkout sets Paddle's own cookies, as before.
• The builder app itself currently runs without analytics scripts — section 7.

2. The consent banner

On your first visit (and again once a saved choice is older than 12 months) a banner offers two equal choices: Decline and Allow analytics. There is no hidden third state — closing nothing, scrolling on, or never touching the banner leaves consent denied, exactly as if you had declined, except that we keep asking on later visits until you choose.

Your answer is saved in your browser as a localStorage entry named ns:consent:v1 (the choice and its date — it never leaves your browser by itself). We re-ask after 12 months. The footer's Cookie settings control reopens the banner whenever you want to change the answer.

3. Cookies we set (after you accept)

Before you accept — and at all times after you decline — the list below is empty: our servers send no Set-Cookie header and Google's script writes nothing. After you accept, Google Analytics sets these first-party cookies on nestsheet.com:

Cookie	Purpose	Lifetime
_ga	Google Analytics — tells returning browsers apart using a random identifier.	Up to 2 years from your last visit
_ga_*	Google Analytics — keeps session state for this site's GA4 property.	Up to 2 years from your last visit

Some browsers shorten these lifetimes on their own — Safari, for example, caps script-set cookies at 7 days. In Google Analytics we keep user-level reporting data for 14 months; the Privacy Policy covers what is collected and on what legal basis.

4. What happens when you decline

Here is the part most cookie policies skip. We run Google's tag in Consent Mode (advanced): the script itself loads for everyone, and while consent is denied it writes nothing to your device and sends only cookieless "pings" — anonymous signals without a persistent identifier, with ad personalisation off. Google uses them for aggregate modelling, such as estimating overall visit counts. They are not used to build a profile of you, and there is nothing on your device linking visits together.

If you want to block even those pings, a browser content blocker that stops googletagmanager.com does it — the site keeps working without the tag.

5. What lives in localStorage

localStorage is browser storage that never travels with requests by itself. We treat it with the same transparency a cookie table gets:

What	Purpose	When it goes away
Sign-in token	Keeps you signed in to the builder between visits. A JSON Web Token — there is no session cookie.	Removed when you sign out; unused sessions expire on their own.
ns:consent:v1	Your cookie-banner choice and its date, read locally on each page.	Re-asked after 12 months; cleared with site data.
Current project (ns_session)	The sheet you are working on, autosaved so a reload does not lose it: project name, sheet setup, records of your uploaded images (file names, dimensions, and links to the copies on our servers — not the image files themselves), where each item sits on the sheet, and production settings.	Cleared when you empty the canvas or start a new project; also cleared with site data.
Sheet snapshots (ns_saved_sheets)	Named snapshots of a sheet you save in the builder with the Shift+S keyboard shortcut (Shift+L opens the list to load, rename, or delete them). Each snapshot holds the same kind of project data as above under the name you give it, plus an optional small preview image — the artwork files themselves stay on our servers. The builder keeps the newest 20.	Removed when you delete a snapshot from that list; the oldest is dropped once there are more than 20. Cleared with site data.
Active export (ns_activeExportJob)	The job's id plus the file name and format you chose, so an export — still rendering or just finished — survives a page reload.	Removed when the export fails or you cancel it. After a successful finish: right away if the export dialog is still open; if it finished in the background, kept until you download the file. If the 72-hour download link expires first (or the export is otherwise gone), the record is removed the next time the builder notices — when you next open or reload the builder, or try the download; until then it stays, unless a new export replaces it. Cleared with site data.
Builder preferences	Units, dismissed hints, saved export profiles, workspace layout — so the bench looks the way you left it.	Cleared when you clear site data for nestsheet.com.

6. Third-party cookies (Paddle checkout)

When you start a paid subscription or update payment details, the checkout is an embedded iframe from Paddle, our merchant of record. Inside that iframe Paddle sets its own cookies under its own domain for secure payment processing and fraud prevention — they are controlled by Paddle, not us, and your consent-banner choice does not affect them. See paddle.com/legal/cookie-policy .

Beyond Google Analytics on this website and Paddle inside its checkout, no other third-party scripts, iframes, widgets, or pixels are embedded on nestsheet.com.

7. The builder app

The GA4 tag runs on this marketing website only. The builder app itself currently runs without analytics scripts — what the app sends to our servers (your files, sheet data, first-party diagnostic logs) is described in the Privacy Policy. If that changes, this page and the Privacy Policy change first and the "Last updated" date moves.

8. Changing your mind and clearing cookies

• Withdraw or grant consent any time via Cookie settings in the footer. Choosing Decline after an earlier Accept switches consent to denied on the spot — from that moment Google sets no new cookies and reverts to the cookieless signals of section 4.
• Cookies already on your device are not deleted by withdrawing — they expire on their own (section 3) or can be removed immediately in your browser, usually under Settings → Privacy → Site data for nestsheet.com. Clearing site data also resets your saved banner choice and signs you out of the builder.
• Blocking cookies in your browser does not break nestsheet.com. The Paddle checkout does need its own cookies to process a payment.
• Google also offers a browser add-on that disables Google Analytics everywhere: tools.google.com/dlpage/gaoptout .

9. Changes

If we add a cookie, a new class of browser storage, or a new analytics tool anywhere on nestsheet.com — including the builder app — this page changes first and the "Last updated" date moves. Anything non-essential ships behind the same consent banner.

10. Contact

Questions about this page: [email protected]. Broader privacy questions: the Privacy Policy.

---

Operator of nestsheet.com: NestSheet. Questions about this document: [email protected].

Launch-v1 baseline. Drafted by the NestSheet team for public compliance at launch; it will be refined by counsel post-launch and any material change will be announced via email and dated above.