Cookie policy
There are three cookies in the whole of Noddable, all of them strictly necessary, and none of them belongs to anyone else. This page lists them.
Version 2026-09-16 · In effect from 16 September 2026 · Last updated 16 September 2026
Published by [REGISTERED COMPANY NAME] Limited, company number [COMPANY NUMBER], registered in
England and Wales. Questions: legal@noddable.com
1. Why there is no banner
Under the Privacy and Electronic Communications Regulations 2003 (regulation 6), consent is needed before storing anything on a visitor's device — unless it is strictly necessary to provide a service the person has actually asked for. That exemption is narrow, and it is routinely stretched. We have kept inside it by not having anything to stretch it around: no analytics cookie, no advertising cookie, no preference cookie, nothing belonging to a third party.
The visitor statistics we offer customers work without storing anything on the device at all. A page view is counted by a single beacon that the server turns into a daily total; no identifier is created, so there is nothing to ask permission for and nothing to interrupt anyone about.
2. Every cookie we set
| Name | Where | Purpose | Lasts |
|---|---|---|---|
session | Dashboard, after you sign in | Keeps you signed in. Holds a random token; the server stores only its hash. HttpOnly, SameSite=Lax, and Secure in production. | 30 days |
rv_<gallery> | A client gallery link | An anonymous identifier so one reviewer's picks and notes stay theirs and are not shown to another person opening the same link. It is not linked to a name, an address or an account, and it is scoped to that single gallery's path. | 180 days |
gp_<gallery> | A password-protected gallery | Proof that the password was entered correctly, so it is not demanded again on every page. Scoped to that gallery. | Session |
All three are first-party and strictly necessary: without the first you cannot stay signed in, and without the other two a gallery cannot tell one reviewer from another or remember that somebody has already unlocked it. None is used for analytics, advertising or profiling.
3. This website
The pages you are reading now — the marketing pages and these legal documents — load nothing from another domain. The typeface is served from our own domain rather than from a font network, which is why visiting this page sends your address to nobody but us. Two things are stored on your device, both set by us and readable by nobody else:
| Name | What it holds | Why | Lasts |
|---|---|---|---|
exp | Which version of a page element you were shown, for example hero-cta:b. No identifier of you. | We sometimes test two wordings of a button against each other. This keeps the version you first saw the same if you come back, so the test measures people rather than page loads and you are not shown a different button on every visit. | 30 days |
cms.v (session storage, not a cookie) | A single flag meaning "this tab has already counted an arrival". | Tells our visitor statistics a first page view from a page turn. Nothing about you is in it and it never leaves your browser. | Until the tab closes |
Our statistics record counts per page per day, the referring site and the country of an
arrival, and nothing else — no address, no identifier, no profile. The exp cookie
is not strictly necessary to show you the page, so you may refuse it: block cookies for
noddable.com in your browser and everything here still works, you will simply see whichever
wording is drawn on each visit.
4. Websites we publish for customers
A site published on Noddable sets no cookies of its own. Media may be served from our own media domain, which sets none either. If a site has visitor statistics switched on, that adds one request per page view and still stores nothing on the device.
5. Cookies you add yourself
If you are a customer and you embed something from elsewhere — a booking widget, a video player, a chat box, a map — that third party may set its own cookies on your visitors' devices. We cannot see or control those. If you add one, the obligation to tell your visitors and to obtain consent where it is needed becomes yours, and you will need your own cookie notice. This is set out in clause 11 of the terms of service.
6. Controlling cookies
Every browser lets you see, block and delete cookies. Blocking the three above will stop you signing in and stop a gallery working properly, which is the definition of strictly necessary. Deleting them signs you out and makes a gallery treat you as a new reviewer.
Questions about anything on this page: privacy@noddable.com.