Legal

Cookie Policy

Last updated: 18 October 2026 · Nosht Limited

This Cookie Policy explains how Nosht uses cookies and similar technologies when you visit or use the Nosht service. It should be read alongside our Privacy Policy.

Cookie settings

You have not made a choice yet — necessary cookies only are in use.

What are cookies?

Cookies are small text files placed on your device by a website or application. They are widely used to make services work more efficiently, to provide information to site operators, and to remember your preferences. Browser "local storage" and "session storage" serve a similar purpose but are not transmitted with every HTTP request.

Cookies and storage we use

Nosht uses a minimal set of cookies and browser storage mechanisms. Authentication and functional cookies are first-party only — set and read exclusively by the nosht.io domain. The one exception is Stripe's fraud-prevention cookies (including a third-party cookie on m.stripe.com), which are set only when a signed-in user confirms a card payment; see the table below. Optional analytics (Microsoft Clarity, PostHog and Sentry Session Replay) are strictly opt-in via our cookie banner — never on by default. Separately, when you are signed in we record which Nosht features you use in our own database (product usage analytics, described below); this sets no cookies and you can switch it off in Settings → Account.

We don't run advertising or retargeting campaigns and don't use social-media pixels. Note that Microsoft Clarity, if you accept analytics, sets Microsoft identifiers (MUID, CLID) that Microsoft also uses across its own services, including advertising. If you don't want that, choose "Necessary only".

Third-party content: our App Store badge is served from our own site, so showing it sends nothing to Apple. If you follow the link, Apple's App Store handles that visit under its own policy.

Name / Type	Provider	Category	Purpose	Duration
Supabase auth token sb-…-auth-token (local storage)	Nosht (stored by Supabase, our hosting provider)	Strictly necessary	Authenticates you and keeps you logged in to your Nosht account. Without this token, you would need to log in on every page load.	Until you sign out; idle tabs sign out after 8 hours
Local storage (preferences)	Nosht	Strictly necessary	Stores UI preferences (such as tooth notation system and theme) locally in your browser. This data is never sent to any server or third party.	Until cleared by you
Cookie consent preference nosht_consent_v2 (local storage)	Nosht	Strictly necessary	Records your choice (analytics on or off), when you made it and which version of this notice it applies to, so the banner is not shown again until we ask again after 12 months, or sooner if the cookies we use change. If you are signed in, the same record is also kept with your account until you delete it.	12 months, then we ask again
Note draft auto-save	Nosht	Strictly necessary	Local backup of your unsaved clinical note drafts in your browser (localStorage, nosht_draft_), in case of network interruption. Removed once the draft is saved to the server, when you sign out, or after 30 days at most. It may contain patient details you typed, such as Referral Letter name and date of birth, so do not stay signed in on a shared computer. Never sent to third parties.	Until saved, sign-out, or 30 days at most
User session cache nosht_user_cache (local storage)	Nosht	Strictly necessary	Caches your account profile locally so the app loads instantly without a loading spinner on return visits. Refreshed from the server within 5 minutes.	5-minute TTL / until cleared
Query cache nosht-query-cache-v3 (local storage)	Nosht	Strictly necessary	Keeps recently loaded account data (for example your note list) in your browser so screens open instantly. Refreshed from the server and never sent to a third party. It can hold what those screens showed, so do not stay signed in on a shared computer.	Up to 24 hours
UI state & feature hints	Nosht	Strictly necessary	Stores interface state such as dark/light theme, gloved mode, high contrast mode, recently used templates, dismissed feature hints, and notification read status. Never sent to any server or third party.	Until cleared by you
Version check throttle nosht_vc (session storage)	Nosht	Strictly necessary	Prevents excessive server checks for application updates. Stored in session storage and cleared automatically when you close the browser tab.	Browser session only
Stripe (payments) __stripe_mid, __stripe_sid (first-party cookies); m on m.stripe.com (third-party cookie)	Stripe	Strictly necessary	Set by Stripe, our payment processor, for fraud prevention. Stripe's script loads on nosht.io only when a plan change needs your card to be authenticated; checkout itself happens on Stripe's own pages (checkout.stripe.com), under Stripe's cookie policy.	__stripe_mid 1 year; __stripe_sid 30 minutes; m as set by Stripe (see Stripe's cookie settings)
Microsoft Clarity _clck, _clsk (first-party); CLID, MUID, ANONCHK, MR, SM (third-party, clarity.ms / bing.com)	Microsoft (Clarity)	Analytics (opt-in)	Set only after you click "Accept all", on our public marketing pages. Recognises your browser between visits and links page views into one session.	_clck 1 year; _clsk 1 day; third-party cookies up to 1 year
PostHog ph_<project key>_posthog (first-party cookie) and PostHog local storage	PostHog	Analytics (opt-in)	Set only after you click "Accept all". Recognises your device between visits for product analytics.	1 year
Sentry Session Replay sentryReplaySession (session storage)	Sentry (Functional Software, Inc.)	Analytics (opt-in)	Set only if you allow session replay in the banner's Details (or choose Accept all), and never on note-writing or other clinical pages. A short session identifier for Sentry's Session Replay, described below.	Until you close the tab or withdraw consent
Product usage analytics opt-out	Nosht	Strictly necessary	Stored only if you switch off product usage analytics in Settings → Account, so we can honour that choice on this browser. Removed if you switch it back on.	Until you switch analytics back on or clear it
AI unlock and first-fill markers	Nosht	Strictly necessary	Remember, for your account on this browser, that Nosht AI has been unlocked on a template and that you have applied your first AI fill, so the one-time unlock message, its celebration and the first-fill guidance are shown only once. Stored whether or not you accept analytics. Never sent to any server or third party.	Until cleared by you
Activation milestone markers	Nosht	Optional analytics	Stored only if you accept analytics in our cookie banner. Prevents the same activation milestone (for example, your first completed note) being counted twice in our product usage analytics. Never sent to any server or third party.	Until cleared by you

Legal basis (PECR)

Under the Privacy and Electronic Communications Regulations 2003 (PECR), consent is not required for cookies that are strictly necessary for the operation of a service that the user has explicitly requested.

Authentication and functional cookies fall into the "strictly necessary" category and do not require consent under PECR. Optional analytics (Microsoft Clarity, PostHog, Sentry Session Replay, and Nosht's own usage events) require your explicit opt-in via the cookie banner. You can change or withdraw your choice at any time using the buttons at the top of this page, or "Cookie settings" in the footer or in Settings → Account. Withdrawing stops Clarity and PostHog immediately.

Our first-party product usage analytics do not depend on the cookie banner. They set no cookies and run under our legitimate interest in improving the service (see below and our Privacy Policy). You can object at any time in Settings → Account → Product usage analytics.

Product usage analytics (first-party)

When you are signed in, we record which Nosht features you use (for example, the template opened, a note completed, an AI fill applied), with counts and timings, linked to your account. We use this to fix problems and improve the service.

It never includes note text
It is kept in our own database and is not shared with third parties
It sets no cookies; the related browser storage is listed in the table above
It runs whether or not you accept analytics in the cookie banner
If a note fails to save or complete, or the app hits an error, while you are signed in, we also keep a reliability record (the operation, the error type and an incident reference, never note content) to keep the service working. It stores nothing on your device and is kept whether or not you accept analytics or switch product usage analytics off

Lawful basis: legitimate interests (improving the service). Your choice: switch it off at any time in Settings → Account → Product usage analytics. See our Privacy Policy.

Optional analytics — Microsoft Clarity

If you accept analytics in our cookie banner, we use Microsoft Clarity to understand how visitors use our public marketing pages. Clarity runs ONLY on those public pages (homepage, blog, and marketing/landing pages) and is never loaded inside the signed-in Nosht app, so it cannot see your clinical notes or any patient information. Clarity records aggregated behavioural data — clicks, scrolls, page navigation, and pseudonymous session recordings linked by a 1-year Clarity ID. We use this to improve site usability.

Cookies and storage Clarity sets (only after you accept, and only on the public pages above): _clck (1 year — links your browser's visits together), _clsk (1 day — links page views within one session) and _cltk (a per-page token held in session storage, not a cookie).

Privacy controls applied:

Loaded ONLY on our public marketing pages — it is never injected on any authenticated or clinical route (note writer, dashboard, clinical tools, settings), nor on a patient-facing leaflet page or embed. This is enforced in code, not just configuration
Loads only after you click "Accept all" in our cookie banner — never on by default
Stops collecting if you change your consent preference, or as soon as you navigate into the signed-in app
Microsoft acts as our processor under its Data Protection Addendum. Clarity data may be processed in the United States under Standard Contractual Clauses / the UK Addendum
Patient clinical data and patient identifiers within the Nosht app are never tracked by Clarity — it does not load on the pages where any such data appears
Our Content-Security-Policy blocks Clarity's requests from our pages to Bing (c.bing.com), so Bing's cookies (MUID on bing.com, SRM_B, MR) are not set through our site. Clarity's own servers on clarity.ms can still set Microsoft identifiers on that domain (MUID, SM, MR, ANONCHK) once you accept analytics
Never loaded on the patient leaflet pages a clinician sends (nosht.io/p/…) or on our embedded widgets (nosht.io/embed/…)

Microsoft Clarity's privacy details are in its privacy FAQ.

Optional analytics — PostHog

If you accept analytics in our cookie banner, we also use PostHog (PostHog EU Cloud, hosted at eu.posthog.com) for product and funnel analytics — understanding which pages and features people use so we can improve the app.

What PostHog does:

Sets first-party-style cookies and uses local storage in your browser to recognise your device between visits
Records which pages and features you use, and when, to map how people move through the product
After you sign in, links these usage events to your account (by your user ID) so we can analyse the signed-in experience — PostHog analytics are therefore not anonymous
Loads only after you click "Accept all" in our cookie banner — never on by default — and stops collecting if you withdraw consent
Does not capture patient clinical data; sensitive values such as invite and sign-in tokens are stripped from the page addresses we send to PostHog
Sends nothing from the patient leaflet pages a clinician sends (nosht.io/p/…) or from our embedded widgets (nosht.io/embed/…). Our cookie banner is not shown there, so a patient opening a leaflet link is never asked to accept analytics

Lawful basis: your consent (opt-in only, off by default, withdrawable at any time). Data location: the European Union (PostHog EU Cloud). PostHog acts as our Data Processor under a Data Processing Agreement.

Optional analytics — Sentry Session Replay

If you allow session replay in our cookie banner (under Details, or by choosing "Accept all"), we also use Sentry's Session Replay feature alongside the application-error monitoring we already run (see our Privacy Policy for how error monitoring itself works). Replay reconstructs what was on screen around an error to help us diagnose it.

What Session Replay does:

Loads only after you allow session replay (or click "Accept all") in our cookie banner — never on by default — and stops recording if you withdraw consent
Is switched off on note-writing and other clinical pages (the note writer and demo note writer, dashboard, practice dashboard, recalls, clinical tools and admin pages) and on the patient leaflet links, so nothing on those pages is recorded
Masks all on-screen text and blocks all media before anything leaves your browser, so clinical note content is never captured even while Replay is recording
Only attaches your signed-in user ID to error reports once you have given that analytics consent
Keeps a short session identifier in your browser's session storage (sentryReplaySession, Sentry), which is cleared when you close the tab or withdraw consent
Does not run on its own — it only augments an error report; Sentry's underlying error capture is on by default under our legitimate interest in keeping the service secure and reliable, with emails, names and IP addresses scrubbed

Lawful basis: your consent, for the Replay recording itself (opt-in only, off by default, withdrawable at any time). Data location: Sentry (Functional Software, Inc.) may process data in the United States, under a Data Processing Addendum incorporating Standard Contractual Clauses for transfers outside the UK/EEA.

Optional analytics — Nosht usage events

If you accept analytics in our cookie banner, we also record our own first-party usage events — for example, which tools or screens you open — so we can understand how the app is used and improve it. No third party is involved: the events are stored in our own Supabase database, in the same UK (London) region as your account data.

What this does:

Uses a pseudonymous session identifier, stored in your browser's session storage (cleared when you close the tab), to group events from the same visit
After you sign in, links these events to your account so we can analyse the signed-in experience
Loads only after you allow session replay (or click "Accept all") in our cookie banner — never on by default — and stops recording if you withdraw consent
Is switched off on note-writing and other clinical pages (the note writer and demo note writer, dashboard, practice dashboard, recalls, clinical tools and admin pages) and on the patient leaflet links, so nothing on those pages is recorded
Does not capture patient clinical data — only feature and screen names and similar product-usage signals, never content you typed

Lawful basis: your consent (opt-in only, off by default, withdrawable at any time). Data location: the United Kingdom (the same Supabase London region as your account data) — see our Privacy Policy.

What we do not use

×Google Analytics — we do not use it; our analytics are our own first-party product usage analytics and the opt-in Microsoft Clarity, PostHog and Sentry Session Replay described above

×Facebook Pixel, LinkedIn Insight Tag, or any social media tracking pixel

×Advertising or retargeting cookies set by Nosht

×Cross-site tracking or fingerprinting technologies of our own (the identifiers Microsoft Clarity may set after you accept analytics are described above)

×Any cookie or storage mechanism that transmits data to third parties for marketing purposes, other than the Microsoft identifiers Clarity itself sets when you accept analytics (see above)

×Tracking of patient clinical data within the Nosht app under any circumstances

Managing cookies

You can clear cookies and local storage at any time through your browser settings. Please note that doing so will log you out of Nosht and reset any locally stored preferences. You will need to log in again on your next visit.

For instructions on managing cookies in your browser, consult your browser's help documentation or visit aboutcookies.org.

Changes to this policy

If we add or change any non-essential cookie we will update this page and ask for your consent again. We will not retrospectively change the classification of existing cookies without updating this page.

Questions?

If you have questions about our use of cookies, please contact us.

hello@nosht.io

Changes to this document

18 October 2026

These changes take effect on 17 November 2026.

Every cookie and similar technology is named.
Stripe’s fraud-prevention cookies are set only when you confirm a card payment.
Microsoft Clarity, Sentry Session Replay and the local draft backup are described.
This policy covers the whole Nosht service.
Each item names its provider, session replay is a separate choice, and the one-time markers we keep for the app are listed as strictly necessary.