Cookie Policy

Cookies and browser storage

Cookies can accompany requests to a website. Local storage stays in the browser for an origin until removed or handled by the application. Session storage supports a browsing session and can be restored according to browser behavior. These technologies can support security and user-requested functions as well as optional tracking.

The inventory below explains the browser storage used by the service. Optional analytics requires your explicit choice; basic site functions remain available when you reject it.

Current storage inventory

gonursego:appearance:v1 — first-party local storage for selected light or dark appearance. No application-set expiry; lasts until removed or replaced.

gng-public-navigation-collapsed-v1 — first-party local storage for your expanded or collapsed sidebar preference. No application-set expiry.

gonursego:directory-v2:view:v1 and gonursego:directory-v2:map-auto-search:v1 — first-party session storage for directory view and map-search preferences. Intended for the browsing session.

gonursego:directory-v2:return-state — first-party session storage for returning from a campus profile to directory filters, view, selection, and scroll position. Consumed when restored or removed if invalid; otherwise tied to session storage.

gonursego:privacy-choice:v1 — first-party local storage for policy version, optional category choices, decision time, and expiry. The product default is 180 days for both permission and refusal, not a universal statutory period.

sb-<project-ref>-auth-token, potentially split into numbered chunks — Supabase authentication cookies on the application origin for administrator sessions. The installed server-side authentication library has a 400-day cookie max-age default, but actual session validity, refresh, browser limits, and runtime expiry may differ. This is source-confirmed behavior, not an observed signed-in cookie inventory.

Cloudflare Turnstile — spam-protection code loads when Contact or Product Updates has a configured site key. Challenge tokens and any provider storage depend on challenge behavior. Provider storage can vary by challenge. A Turnstile token is not automatically a cf_clearance cookie.

Service providers and inactive categories

Vercel delivers the application and may provide Preview protection and review tooling. Vercel's own Preview toolbar or protection is separate from product analytics. Supabase supports application and authentication requests. OpenFreeMap supplies map resources; this inventory identifies no map-tracking cookie set by GoNurseGo.

Google Analytics (G-VXWXR35QGN) is restricted to consented public-page measurement on gonursego.org. It does not load in Preview, before permission, or when Global Privacy Control is active. The integration sends allowlisted page labels, excluding search queries, Guide answers, contact contents and account pages. Advertising tracking remains disabled. This first-party preference system is not a Google-certified advertising consent platform. The static GMEC banner is an external link and does not activate advertising tracking.

Changing and saving a choice

Open Privacy choices from the footer or this page. The manager describes available categories and lets you save a choice or cancel without saving. Optional analytics is unavailable in Preview. On gonursego.org, you can accept or reject optional analytics, or change the choice in this manager.

A saved choice applies to this browser and origin. It does not transfer authentication or consent to another Preview address. An ignored or closed notice does not turn on tracking. Missing, corrupt, expired, outdated, or unavailable storage keeps optional tracking off. Other tabs on the same origin update when a stored choice changes.

Withdrawal and browser controls

Analytics permission must be explicit and can be withdrawn through Privacy choices. Withdrawal removes the Analytics context and clears its first-party _ga and _ga_* cookies; it does not indiscriminately clear sign-in, CAPTCHA, theme, or directory state.

Withdrawal cannot erase information a provider already received. A request about backend records is separate from browser settings. Browser clearing may remove privacy choices and other preferences. If the browser cannot store a choice, optional tracking remains off and browsing remains available.

Global Privacy Control and questions

An available Global Privacy Control signal keeps advertising and sale/sharing purposes disabled. This product also keeps optional analytics off when the signal is active; that is a conservative product choice rather than a claim that every GPC rule covers analytics. The older Do Not Track setting is not treated as GPC.

Contact info@gonursego.org with questions. Requests about stored messages or provider records are separate from browser privacy choices.