Cookies

Necessary session cookie (POPIA openness)

Nova Fleet sets one first-party cookie: nova_user_id. It is necessary to keep you signed in after email/password login. It holds a signed session token (not your password). It is httpOnly, SameSite=Lax, path=/. On this localhost build it is not Secure. When the site is served over HTTPS, including Cloudflare in front of the public host, the cookie is marked Secure.

There are no analytics, advertising, or optional cookies. There is no consent management platform. The first-visit banner is an openness notice under POPIA, not Accept-all tracking consent. Accept dismisses the banner; it does not enable tracking.

Information Officer (placeholder): [Information Officer email TBD].

Related storage

The cookie notice remembers dismiss in localStorage under nova_cookie_notice_dismissed. That is not a cookie. Clearing site data shows the notice again.

Third parties and cross-border

Live maps load raster tiles from OpenStreetMap (tile.openstreetmap.org). OpenStreetMap is a third party. Map tiles and geodata remain © OpenStreetMap contributors.

OpenStreetMap tiles are fetched from servers that are typically outside South Africa (cross-border transfer of map-tile requests). This localhost build has no production host; a future production region is [Host region TBD].

Nova Fleet does not set OpenStreetMap cookies. Loading tiles is a network request to a third party.

How to control

You can dismiss the first-visit notice; that does not disable the session cookie. Log out to clear the session cookie. Blocking all cookies will prevent sign-in.