Privacy policy
Privacy policy — PLACEHOLDER
This document is not a legal text. It was seeded into the test environment so that the archive mechanism works end to end: a version quoted by a consent record must name a text that exists. It binds you to nothing and binds Noowow to nothing.
What must replace it
The real text, drafted with counsel, published through the same route POST /v1/admin/legal/privacy with current: true. The archive is immutable: this version stays readable under its own number, which is exactly the guarantee the platform offers anybody who accepted something.
Why it exists at all
Because the alternative was worse. The legal.privacyVersion setting named version "2026-08-01" while no text had ever been published under it: the public page answered 404, and every recorded consent pointed at nothing. A placeholder that declares itself is honest; a pointer to nothing is not.
What we store on your device
This list is generated from the code, on every release: it cannot be out of date. No cookie appears in it, because the platform sets none.
While reading the site
Nothing is written. You can browse competitions, profiles and rankings without any data being placed on your device. One preference is read back if it is already there:
nds-themeread, never written by usA light or dark theme preference. The site follows your system setting and does not write it; it only reads one back if it is already there.
When you sign in
What your session needs, and what disappears when you close the tab:
oidc.user:…cleared when the tab closesYour session: the tokens proving you are signed in. They disappear with the tab.oidc.…cleared when the tab closesThe proof that the sign-in response really comes from the identity provider and was not forged.noowow.signin.redirectcleared when the tab closesThe page you meant to open before signing in, so we can take you back to it. Cleared as soon as it has served.accessTokennever writtenThe access token itself is written nowhere: it lives in the page and vanishes with it. A token written to the device is a token a malicious script could read.
When you vote for or back a talent
What exists so an interrupted action does not have to be started over:
noowow.vote.intentkept on the deviceA free vote begun before you signed in, kept for fifteen minutes so you do not have to start over. It is cleared as soon as it is picked up, and a purchase is never resumed on its own.noowow.support.orderkept on the deviceAn order in progress, kept for seven days, so your purchase is found again when you return from the payment page.
Arriving from a promoted card
A promoted card carries the code of the campaign that paid for it. It is kept for one hour, in this tab only, so the organisation knows its placement brought somebody. It names a campaign, never you:
noowow.campaign.attributioncleared when the tab closesThe code of the campaign you arrived through. It holds nothing about you, never leaves this tab, and is forgotten after an hour.
Preparing a publication
What keeps you from losing what you just wrote if you navigate away:
noowow.publish.draftcleared when the tab closesThe draft of the publication you are composing: its title, its description, the competition it targets. It goes when the tab closes, and the files themselves are never kept.
This text is frozen. Correcting it, here, means publishing a new version, and you are told before it applies. Previous versions stay readable.