1. What this covers

A cookie is a small piece of text a website asks your browser to keep and send back on the next request. Italian law (art. 122 of Legislative Decree 196/2003) treats other ways of storing things on your device the same way, and the Garante said so expressly in its guidelines of 10 June 2021. So this page lists everything Nesso stores on your device, not only the cookies.

2. The cookies

Name	What it does	How long	Type
nesso_session	Identifies the record you are building, so what you tap on one screen is there on the next. It holds a random identifier and a signature: no name, no address, nothing readable.	180 days, renewed while you use Nesso	First party, strictly necessary
nesso_user	Says which signed-in browser this is. It holds the identifier of one signed-in session and a signature, so that signing out of this browser, or out of all of them, actually ends it.	180 days, or until you sign out	First party, strictly necessary
nesso_lang	Remembers which language you are reading Nesso in, so that choosing a language on a public page also chooses it for signing in and for the app. It holds a two-letter language code and nothing else. It is set when you press a language, and also when you open a landing page in a language and have never chosen one.	1 year, renewed when you choose a language	First party, strictly necessary
nesso_consent	Remembers what you answered in the cookie banner, so it is not asked again on every page. It holds your yes or no for analytics and for advertising, and nothing about you.	Six months, then you are asked again	First party, strictly necessary
nesso_country	Remembers which country you chose to look at, Italy or Denmark, so every part of Nesso shows that country. It holds a two-letter country code and nothing else, and is set only when you choose one.	1 year	First party, strictly necessary
nesso_oauth	Exists only while you sign in with Google or Apple: it lets Nesso check that the answer coming back belongs to the sign-in you started. It holds a random value and a signature, and is sent only to the sign-in addresses.	10 minutes	First party, strictly necessary

nesso_session, nesso_user and nesso_oauth are marked HttpOnly, so no script running on the page can read them; all six are SameSite Lax, so another website cannot use them to act as you, and Secure where the site runs over an encrypted connection. nesso_lang, nesso_consent and nesso_country are set by the page itself when you press the control, which is why a script can read them.

3. What else is stored on your device

Offline pages (Cache Storage): A service worker keeps copies of pages you have opened, under the name nesso-offline-v2, so the viewing kit still works in a basement with no signal. It is filled by what you visit and never by anything else.
The offline map (device file storage): If you ask for the map to be available offline, the map archive is written to a folder named basemap in your browser private storage. It is written only when you press the control that offers it, and the same screen removes it.
Photos of your saved flats (IndexedDB): If you add a photo to a saved property check, it is kept in this browser in a database named nesso-covers, shrunk and with no location data in it. It is written only when you choose a photo, is never sent to Nesso, and goes when you remove the photo or the saved check.
nesso.city (local storage): The last city you opened on a map, so the tab bar takes you back to it. It holds the city name and nothing else, and stays until you clear this site’s data.
nesso.catalogueChecks (local storage): The answers you give to checks on the cards of Inside, kept on this device only. They are not part of a saved walk and are never sent to Nesso.
nesso.prepare (local storage): Answers to Prepare from before they were kept in your account. If a browser still holds some, they are added to your account once and the key is deleted.
nesso.quizPrompt.skipped (session storage): Remembers that you pressed Not now on the quiz, until you close the tab.

Nothing in these stores is sent anywhere: the first two exist so that pages you already loaded keep working without a connection, the photos are only those you chose to add, and the keys in local and session storage are conveniences for this browser.

4. No third-party cookies today

Not live yet: an advertising network, retargeting or a conversion pixel. See section 5 for what happens before any of that ships.
No outside analytics provider. The product log and the page counts we keep are our own, in our own database, and set nothing on your device beyond the cookies above.
No embedded video, no social buttons, no comment widget, no chat widget.
The typefaces are served from our own domain, so no font provider sees your request.
The map tiles and the map worker are served from our own domain, so no map vendor sees your request.

So the one optional thing the banner can switch on is our own page counting, described in section 5.

5. What the banner asks, and what a yes does today

Art. 122(1) of Legislative Decree 196/2003 requires your consent before storing anything on your device, except where it is strictly necessary to provide the service you asked for. Everything in sections 2 and 3 is that kind of storage and is always on.

The banner asks about two optional kinds. Analytics: with your yes, each page you open is counted in our own database, as the page address with any identifier removed, the day, the website that sent you (its name only) and whether the screen was a phone, a tablet or a computer, kept for thirteen months. It uses the nesso_session cookie above to count two pages as one visit, and sets no cookie of its own. No outside service sees any of it. Personalised advertising: not live, so a yes to it switches nothing on today.

Reject all, or closing the banner, means no to both, and the site works exactly the same. If you are signed in, the same answer is saved on your account privacy settings, and changing it there changes it here.

6. Removing them yourself

Every browser lets you see and delete cookies and site data, usually under settings for privacy or for site permissions. Clearing site data for this domain removes every cookie above, the offline pages and the offline map together, and the banner asks again on your next visit.

What that costs: you will be signed out, and an anonymous record you had not attached to an account becomes unreachable, because the cookie was the only thing pointing at it. Signing in first, then clearing, keeps the record and loses only the browser session.

Blocking cookies for this domain entirely leaves the public pages readable and stops sign-in from working, because there is no other way for the site to tell one request from the next.

7. Changes

The date at the top is when this version was written. Any new cookie or store is added to the table above before it is set for the first time.

Cookies, and the ones we use