Cookie Policy — nosweat.finance

Küpsisepoliitika — nosweat.finance

Document status: Master draft in English. The live page at /et/kupsised must be in Estonian. Estonian version prevails.

Rendered pages: src/app/[locale]/kupsised/page.tsx

Legal basis: Elektroonilise side seadus (ESS) § 102 (implementing ePrivacy Directive 2002/58/EC Art. 5(3)); GDPR Art. 6; AKI enforcement position (2023–2025)

Implementation component: src/components/layout/CookieConsent.tsx — see § 4 for required UX behaviour.

Last updated: 2026-08-08 | Version: 1.3

1. What Are Cookies

Cookies are small text files placed on your device when you visit a website. We also use similar technologies (localStorage for consent preferences). Together these are referred to as "cookies" in this policy.

2. Cookies We Use

2.1 Strictly Necessary Cookies

These cookies are essential for the service to function. They cannot be disabled. No consent is required under ESS § 102 because they are necessary to provide the service you have explicitly requested.

Note on Cloudflare cookies: These are set by Cloudflare's infrastructure (WAF/bot protection) and are classified as strictly necessary because they protect the integrity of authentication. Turnstile itself does not set a persistent tracking cookie — it uses a one-time challenge token.

2.2 Functional Cookies

These cookies remember your preferences. They do not track you across sites.

Functional cookies do not require consent under the AKI's guidance when they serve a user-chosen preference. However, cookie_consent_v2 is set only after you make your choice — it cannot be set before.

2.3 Analytics & Product Insight (consent-gated)

We use PostHog for product analytics, limited session replay, and feature flags — to understand how people experience the interface and to ship changes safely. PostHog runs only after you choose "Nõustu kõigiga" (Accept all). If you choose "Nõustu ainult vajalikega" (Accept necessary only) — or have not yet chosen — no analytics are collected.

Processor & residency: PostHog Cloud EU (Frankfurt) — all analytics data stays in the EU. We do not duplicate business records (e.g. whether you paid) into PostHog; those stay in our own EU database.

Storage: PostHog uses localStorage, not cookies, for its analytics identifier and state. localStorage is still non-essential storage on your device, so it is treated exactly like a non-essential cookie and is set only after your consent.

Privacy safeguards:

• No financial PII is ever sent: never names, email, registry codes, isikukood, IBANs, amounts, or counterparties — only opaque IDs (e.g. company_id).
• Session replay (a masked recording of UI interaction) is limited: all form inputs are masked by default, PII-bearing text is masked via a dedicated CSS class, and replay records only on a small allowlist of non-financial pages (landing, dashboard, login, FAQ, settings). Every financial page (upload, categorize, review, report, export, etc.) is excluded by default. Replay is sampled (~10% of eligible sessions).
• IP address capture is disabled at the PostHog project level.

2.4 Marketing / Third-Party Tracking Cookies (consent-gated)

These cookies are set only when you choose "Nõustu kõigiga" or explicitly enable the Turundus toggle in "Halda eelistusi". If you choose "Ainult vajalikud" or have not yet made a choice, no marketing cookies are set and no ad-network scripts are loaded.

Recipient: Meta Platforms Ireland Ltd and Google Ireland Ltd (see § 3 for transfer safeguards).

Note on the Facebook login button: The Facebook OAuth button on the login page may cause Meta's own cookies to be set if you are already logged into Facebook — this is outside our control and governed by Meta's privacy policy. This is distinct from the Meta Pixel marketing cookie above.

2.5 First-Party Attribution Cookie (legitimate interest)

When you arrive at nosweat.finance through a link that carries campaign parameters (utm_* tags, or the ad-click identifiers gclid from Google and fbclid from Meta), we store those parameters in a first-party cookie so that, if you later become a paying customer, we know which advertising channel brought you.

• Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in measuring the effectiveness of our own advertising. This cookie is therefore not governed by the consent banner.
• The cookie stores only the parameters already present in the address of the link you clicked. It contains no name, no email address, and no other directly identifying data, and it is not used to track you across other websites. No advertising script is loaded on its account.
• The cookie itself is never shared with third parties. If you complete a purchase and the cookie holds a Google click identifier (gclid), we report to Google Ads that this click ended in a purchase — this tells Google only the outcome of a click Google itself served and already knows about.
• You can delete the cookie at any time through your browser (see § 4). The only effect is that your purchase, if any, is recorded without a channel.

3. Consent — What We Ask and When

Under ESS § 102 and AKI enforcement position, non-essential cookies may not be set before the user has given informed, freely given, specific consent. Strictly necessary cookies and functional preference cookies may be set immediately.

3.1 First Visit — Cookie Banner

On first visit to nosweat.finance (before login), a cookie consent banner is displayed:

┌─────────────────────────────────────────────────────────┐
│  Kasutame küpsiseid                                     │
│                                                         │
│  Kasutame küpsiseid teenuse toimimiseks ja              │
│  kasutajakogemuse parandamiseks.                        │
│  Lisateave: [Küpsisepoliitika]                          │
│                                                         │
│  [Nõustu kõigiga]     [Ainult vajalikud]                │
│                                                         │
│            halda eelistusi                              │
└─────────────────────────────────────────────────────────┘

Three paths:

1. Nõustu kõigiga — enables analytics (PostHog) and marketing (Meta Pixel, Google Ads) cookies.
2. Ainult vajalikud — one click; no optional cookies set.
3. Halda eelistusi — opens a preference panel with two independent opt-in toggles ("Analüütikaküpsised" and "Turundusküpsised"), neither pre-ticked. A "Salvesta eelistused" button saves the choice.

UX requirements (AKI compliance):

• "Nõustu kõigiga" and "Ainult vajalikud" must be visually equal — same size, same variant/colour weight. Neither is a ghost/text link or secondary style.
• "Nõustu kõigiga" may be placed first / on the left for natural reading primacy — this is the only permitted asymmetry. Order is not regulated; visual weight is. Both remain one click.
• "Halda eelistusi" is a smaller text link below the two primary buttons — it is a third path, not a primary action, and must not be styled to compete visually with either button.
• No pre-ticked checkboxes in the preference panel.
• A short, non-coercive note may state what "Accept all" enables. It must not imply the service is degraded if the user declines (the report works identically either way), or consent is no longer freely given.
• "Cookie policy" text is a link to /et/kupsised.
• Banner disappears after choice is made.
• Choice is saved to localStorage as cookie_consent_v2: { "analytics": boolean, "marketing": boolean, "ts": timestamp } and mirrored to the cookie_consent_v2 cookie.
• Opt-in model: analytics (PostHog) and marketing cookies are off by default and are enabled only after explicit consent. No analytics, pageview, session replay, or marketing tag fires before that choice.

3.2 Returning Users

Once a consent choice is saved, the banner is not shown again. The saved preference is respected on all subsequent visits — including re-applying it to PostHog on load (a user who accepted analytics is re-enabled; everyone else stays opted out). You can change your choice anytime via the Küpsiste seaded link in the footer.

3.3 Consent for Authenticated Pages

Within the application (post-login), strictly necessary and functional cookies are always used. PostHog analytics and session replay run only if you accepted analytics ("Nõustu kõigiga"). Even then, session replay is excluded from every financial page (upload, categorize, review, report, export, salary-tax, fixed-assets, related-parties) and records only on the limited non-financial allowlist described in § 2.3. If you accepted only necessary cookies, no analytics or replay run anywhere.

4. How to Manage or Delete Cookies

In addition to using the Küpsiste seaded link in the footer, you can manage cookies through your browser settings:

Deleting cookies will log you out of the service (the session cookie will be removed). Your cookie consent preference (stored in localStorage) will also be cleared, so the consent banner will reappear on your next visit.

5. Changes to This Policy

If we add new cookies (especially analytics), we will update this policy and, if the change affects consent-gated cookies, reset consent and re-show the banner to all users.

Change log — version 1.3 (2026-08-08): added § 2.5, the first-party attribution cookie ns_attrib (legitimate interest). No change to what the consent banner governs: analytics and marketing scripts remain strictly opt-in.

6. Contact

Questions about our use of cookies: support@nosweat.finance

For complaints about cookies: Andmekaitse Inspektsioon (AKI) — www.aki.ee, info@aki.ee, Tatari 39, 10134 Tallinn.