<< YOUR LEGAL DETAILS HERE >> marker must be filled in before this can go live.Cookie Policy
Last updated: 2026-09-13
Summary
Boldnest uses a small number of cookies that are strictly necessary to operate the service you asked for — signing you in, keeping your session state, and protecting the app while it's in gated preview. We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party marketing tags. Because all the cookies we set are strictly necessary, no consent banner is required under the ePrivacy Directive (Article 5(3)).
What is a cookie
A cookie is a small piece of data a website stores in your browser so it can recognise you across page loads — for example, keeping you signed in after you enter your password. Cookies can be set by the site you're visiting (first-party) or by services embedded in it (third-party). Boldnest sets only first-party cookies.
Cookies we set
| Name | Purpose | Duration | Category |
|---|---|---|---|
roomai_access | Holds the access code that lets you past the gated preview. Set once when you enter the code at the unlock page. | 30 days | Strictly necessary |
roomai_uid | Links your browser session to your anonymous user record so we can track your free-tier design quota and remember partial work-in-progress. | 1 year | Strictly necessary |
next-auth.session-token(or __Secure-next-auth.session-token on HTTPS) | Your signed-in session, issued after you enter email and password. HTTP-only and (in production) secure-flagged. | 30 days, refreshed on activity | Strictly necessary |
next-auth.csrf-token(or __Host-next-auth.csrf-token) | Protects sign-in and account-mutating requests from cross-site request forgery. | Session | Strictly necessary |
next-auth.callback-url | Remembers where you were trying to go before sign-in so we can return you there after. | Session | Strictly necessary |
What we do NOT use
- No analytics cookies. No Google Analytics, no PostHog, no Plausible, no Mixpanel, no Segment, no Fathom, no Umami. We do use Vercel Web Analytics, which is cookieless: it counts aggregate page views only, sets no cookies or persistent identifiers, and does not track you across sites. Because it stores nothing on your device, it does not fall under the consent rules that apply to cookies and it is not measuring your individual behaviour.
- No advertising cookies. No ad networks, no retargeting pixels, no Meta pixel, no Google Ads tag.
- No cross-site tracking.
- No local-storage-based fingerprinting.
Browser storage that isn't a cookie
Some parts of the app briefly hold data in your browser's sessionStorage — for example, the current design result and the redesign image while you're on the results page. This never leaves your device, and browsers automatically clear it when you close the tab. It's not a cookie and no consent is required.
How to control cookies
Because all our cookies are strictly necessary, disabling them will break sign-in and prevent you from using the app. You can still delete them at any time in your browser's privacy settings.
Changes to this policy
If we ever add optional cookies (for example analytics), we will update this page and prompt you for consent before setting them. Any material change will be reflected in the "Last updated" date at the top.
Contact
For questions about cookies, email << YOUR LEGAL DETAILS HERE — privacy contact >>.