Cookie Policy
NestMint · Last updated: October 30, 2026
The short version
NestMint sets one cookie to keep you signed in, and one short-lived cookie while a Google or employer sign-in is in progress. That is all we set. We do not use advertising trackers or third-party analytics. We do record the limited operational product-usage events described in Privacy Policy Section 1.5. Two outside services load in your browser: Cloudflare's security check on the Create Account form, and Google Fonts for our typefaces; and requests to nestmint.ai travel through Cloudflare's network. All three are described below and in the Privacy Policy, Sections 4 and 5.3.
The cookies we set
Sign-in session (nm_session). Created when
you sign in, removed when you sign out; expires on its own after seven days
without activity and in any case thirty days after sign-in. It holds a
random identifier only — never your name, email, or plan data —
scripts in the page cannot read it, and our servers keep only a one-way
hash of it.
Sign-in transaction (nm_oauth_txn for
Google Sign-In, nm_oidc_txn for employer single sign-on). A
random identifier that ties the sign-in you started in this browser to the
answer that comes back from Google or your employer's identity provider,
so that no other browser can complete it. It lasts at most ten minutes, is
sent only to the sign-in page itself, and is removed when the sign-in
finishes.
Both are strictly necessary for the Service to work, so no consent banner is required for them; they are never shared with anyone.
Browser storage
The Service also keeps a few values in your browser's own storage: whether this browser has signed in before, your light/dark theme choice, where you were in the planning guide, which insights you dismissed, which optional fields the Service has already filled in for you, the Workplace announcement panel's “you closed this” flag and its auto-open counter, and — only if you tick “Remember my username” — a session-only token our servers use to pre-fill your username. That token is linked to your username on our servers. None of the other values identifies you or records what you do in the Service, and clearing your browser storage simply resets them. The full list is in the Privacy Policy, Section 5.
Outside services
When you open the Create Account form, Cloudflare's Turnstile security check runs in your browser to tell people from bots. It receives technical signals such as your IP address and browser details. Some pages also load fonts from Google Fonts, which receives your IP address and browser details. Neither is used by us for tracking, analytics, or advertising. Since October 19, 2026, requests to nestmint.ai (not the Workplace site) also pass through Cloudflare's network on their way to our servers. Cloudflare may set a cookie of its own if it shows you a security challenge page; we do not read or use any Cloudflare cookie. See the Privacy Policy, Section 4, for how these providers use that information.
If this ever changes
If a future feature (for example, payment processing by a billing provider) requires a cookie beyond the ones above, or any tracking or analytics technology, we will update this page and the Privacy Policy before that feature ships, and ask for any consent the law requires at that time.