Naradox
Customer portal
Menu

Cookie policy

Essential browser storage for naradox.com and the portal.

Naradox uses a small amount of browser-side storage to keep the portal secure and to preserve user-facing preferences such as the light or dark theme.

Document details

Version
naradox-cookie-policy-2026-09-03
Effective
September 3, 2026
Acceptance
No acceptance required.

Storage inventory

Production cookie names use the __Host- prefix. All listed cookies are essential, HttpOnly, Secure in production, SameSite=Lax, and limited to the site root.

  • naradox_portal_session: opaque random identifier for a server-side authenticated session; it is a browser-session cookie with no Max-Age or Expires attribute, and only a keyed SHA-256 digest of its value is stored server-side. The server invalidates an administrator session after 15 minutes of inactivity, a customer session after 30 minutes of inactivity, and every session after an absolute maximum of 8 hours regardless of activity. Sign-out, relevant account-security changes, or explicit revocation invalidate it sooner
  • naradox_portal_mfa_challenge: pending sign-in MFA challenge and safe return path; maximum duration 10 minutes and cleared after completion
  • naradox_portal_mfa_enrollment: sealed pending MFA secret and initial backup codes during enrollment; maximum duration 15 minutes and cleared after completion
  • naradox_portal_mfa_backup_codes: sealed one-time display of newly generated backup codes; maximum duration 15 minutes and cleared sooner on logout or replacement
  • naradox_portal_password_reset_preview and naradox_portal_email_verification_preview: local-development preview paths when that explicit preview mode is enabled; maximum duration 15 minutes and not enabled for production browser previews
  • naradox:theme: light or dark interface preference in localStorage; retained until the user changes it or clears browser storage

The portal does not use a separate invitation cookie or CSRF-token cookie. Invitation links are validated server-side. Same-origin request validation, SameSite, Secure, HttpOnly, opaque or sealed values, host-only production names, and server-side authorization protect the relevant browser flows.

Browsers are instructed to discard a browser-session cookie when the browser session ends. Some browser session-restore features can restore session cookies as if the browser had not closed; the server-side inactivity, absolute-expiry, and revocation controls therefore remain authoritative.

Theme preference

The theme preference is used only to restore the interface choice. It is separate from account and billing information and is not sent as a cookie with each request.

Naradox does not show a cookie consent popup while the site only uses essential cookies and user-requested preferences.

  • essential cookies are required for the portal service requested by the user
  • user interface preferences are set by the user's own choice
  • if Naradox adds non-essential analytics, advertising, or tracking storage later, the site will add the required notice and consent or opt-out control before using it

No marketing trackers

The portal is not designed around ad-tech or broad tracking defaults.

  • no customer workflow depends on marketing trackers
  • security and operational logging are handled server-side
  • no non-essential analytics or marketing cookies are enabled
  • future analytics will be disclosed separately and controlled where consent or opt-out is required

Managing browser controls

Users can clear cookies and local storage in browser settings, but some portal behaviour depends on essential storage.

  • blocking or clearing essential cookies may sign the user out or prevent sign-in, MFA enrollment, or account-recovery actions
  • theme preference can revert to the browser default
  • strict browser privacy settings may limit portal convenience features