Novatree sets cookies for one reason: to keep you signed in, securely. No analytics, no advertising, no tracking across sites.
Draft — pending legal review
This document is published for transparency and is not yet final. Highlighted items are still to be completed.
The marketing site at novatree.ai sets no cookies. The application sets only strictly necessary cookies for signing in. We use no analytics, advertising or social-media cookies, and no third party sets cookies through our pages.
All three are first-party, marked HttpOnly (page scripts cannot read them) and Secure (sent only over HTTPS), and are scoped to novatree.ai and its workspace subdomains. They carry a random token and nothing else — no name, email or profile.
| Cookie | Purpose | Duration | Set for |
|---|---|---|---|
novatree_session | Keeps a signed-in user signed in to their workspace. | 30 days, or until you sign out | Workspace users |
novatree_candidate_session | Keeps a candidate signed in to the candidate portal to follow their application. | 30 days, or until they sign out | Candidates |
sso_state | Ties a single sign-on attempt to the browser that started it, so a sign-in cannot be hijacked mid-way. | 10 minutes; removed when sign-in completes | Users signing in with SSO |
The application also keeps a few small items in your browser’s local and session storage. They never leave your device on their own and are not used to track you:
When you pay for a self-serve plan, the payment page is hosted by our payment provider on its own domain, and its cookies there are governed by its own policy. The same applies to your organization’s identity provider when you sign in with SSO.
Under the EU and UK ePrivacy rules, and similar laws elsewhere, consent is required for cookies that are not strictly necessary for a service you have asked for. Every cookie above is strictly necessary — without it you cannot stay signed in — so there is nothing to consent to, and a banner asking would only be noise. If we ever add a cookie that is not strictly necessary, we will update this page and ask for your consent before setting it.
You can delete or block cookies in your browser settings. If you block the cookies above, you will not be able to sign in to Novatree; the marketing site works the same either way. Clearing your browser’s site data removes the stored items in section 3.
Questions about this policy: privacy@novatree.ai. How we handle personal data more broadly is described in the Privacy Policy.
This page is provided for general information and to support customer due diligence. It is not legal advice. Novatree.ai should have this document reviewed by qualified privacy counsel before it is relied upon, particularly regarding GDPR/UK GDPR, CCPA/CPRA, and jurisdiction-specific employment-data obligations.