This is the complete inventory — every cookie and every browser-storage key veilnebu.la writes, not a representative sample. If you find one here that the app does not set, or one the app sets that is not here, that is a defect worth reporting.
1. Strictly necessary
These carry your session and protect it. Clearing them signs you out; blocking them makes the dashboard unusable, because there is no alternative mechanism for keeping you signed in.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
nb_sessionhttpOnly · SameSite=Lax · path /bff | Cookie | Your merchant session token. Held server-side of the browser boundary and re-attached as an Authorization header by our own proxy, so page scripts never see it. | Until the session expires (24 hours) or you sign out |
nb_pkhttpOnly · SameSite=Lax · path /bff | Cookie | Your project API key, attached to dashboard requests the same way. Also never readable by page scripts. | 30 days, or sign-out |
nb_csrfSameSite=Lax · path / | Cookie | Cross-site request forgery defence. Deliberately readable by scripts — the protection is that its value must be echoed back in a header, which a cross-site page cannot do. | 30 days |
nebula.user | localStorage | Non-secret marker for the signed-in UI: your email, your merchant memberships, and when the session expires. Contains no token — the token field is a literal placeholder. | 24 hours; self-clears once expired |
nebula.session | localStorage | A single boolean recording that a project API key exists, so the dashboard knows whether to show the "issue a key" panel. The key itself is in nb_pk. | Until sign-out or cleared |
nebula.mfa.challenge | sessionStorage | Carries the multi-factor challenge from the sign-in screen to the code-entry screen. Deleted the moment the challenge is answered. | Deleted on completion; gone when the tab closes |
Your session token is deliberately kept out of JavaScript-readable storage. It is set as an httpOnly cookie by our own same-origin proxy, which strips it out of the response body before the page ever sees it — so a script injected into the page cannot read or exfiltrate it. The one exception is the anonymous instant-signup token, which is displayed to you once, in memory, and is never written to any storage; that is the only copy that will ever exist, which is why the screen tells you to save it.
2. Functional
Preferences. Nothing here identifies you, and everything here is written only in response to something you did.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
nebula.localeSameSite=Lax · path / | Cookie | Your language choice, written only when you actively pick one. The cookie exists as well as the storage key so the first server-rendered page is already in your language rather than flashing English first. | 365 days |
nebula.locale | localStorage | The same language choice, read by the client on load. | Until cleared |
nebula.referral | localStorage | A referral code you arrived with in the URL, kept so the referral is still credited if you sign up days later. It is the code from the link and nothing else: no identifier is generated, and nothing is sent anywhere until you sign up. Deleted on successful signup. | Until signup or cleared |
3. Operator console
Set only on the administrative surface, which merchants and end-customers never reach. Listed for completeness rather than because it applies to you.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
nb_admin_keyhttpOnly · SameSite=Lax · path /bff/admin | Cookie | Operator admin key, entered by an administrator at the admin sign-in screen. | 8 hours |
nb_admin_sessionhttpOnly · SameSite=Lax · path /bff/admin | Cookie | Admin session identifier, refreshed on each administrative action. | 1 hour, extended on use |
nb_admin_csrfhttpOnly · SameSite=Lax · path /bff/admin | Cookie | Admin CSRF token, rotated on every mutating request. | 1 hour, rotated on use |
nebula.admin | localStorage | Admin console UI state — which API base URL is selected, and whether a session is open. The admin key is explicitly stripped before this is written. | Until cleared |
4. What we do not set
- No third-party analytics — no Google Analytics, Plausible, PostHog, Segment, or equivalent.
- No advertising or retargeting cookies, and no data sold or shared for advertising.
- No browser error-reporting SDK. Error monitoring is server-side only.
- No device fingerprinting, no cross-site identifiers, no session replay.
- No third-party scripts on the page at all. Fonts are self-hosted at build time, so rendering this page makes no request to any other domain.
- No IndexedDB, no service worker, no background beacons.
Performance data — request latency, error rates — is recorded on our servers from requests you make anyway, and aggregated. Nothing is collected from your browser to produce it.
5. Controlling it
Everything above is under your browser’s ordinary controls: clear cookies and site data for this origin at any time. Clearing the session cookies signs you out and nothing more; clearing the preference keys resets the language pick. Signing out actively deletes the session cookies rather than waiting for them to expire.
The wallet is a separate matter entirely: it is a mobile app, it sets no cookies, and it transmits no keys or recovery phrase — see the Privacy Policy §1.