Effective date: 2026-09-23
Version: cookies-account-access-2026-09-23-v1
1. What this notice covers
Real Nova World Corporation uses cookies and related browser technologies to operate Bondora. A cookie is a small value stored by your browser and sent with appropriate requests. Session storage, local storage, and network events can also be used by a website. A technology does not become anonymous or exempt from privacy requirements simply because it is not called a cookie.
Read this notice together with the Privacy Notice. You can review your optional choices through Privacy Choices or the Privacy Settings control available on the site.
2. Necessary technologies
A reading-specific cookie with a name beginning bondora_reading_ is used to authorize access to an individual private reading. It contains signed session information rather than the report text. The current expiry is 30 days after the session is issued. The cookie is configured to prevent ordinary page scripts from reading it and to use secure transmission in production. It should be treated as a private credential.
Session expiry is not a data-deletion schedule. It does not establish the paid access period or remove consumer rights attached to a purchase. A transaction or reading reference is not a substitute for the session credential.
We also use necessary mechanisms for security and for remembering your privacy choices. These purposes are separate from optional product analytics. Administrator-only session technologies are used for restricted operational interfaces, not to create a public customer profile.
3. Optional analytics and draft preferences
Optional analytics measure limited product interactions and are disabled unless you choose to allow them. Rejecting optional analytics does not block access to a preview, purchase, or paid reading. We do not permit reading questions, birth details, report text, or private credentials in analytics event properties.
Where the interface offers to save a draft or remember an optional preference, it explains what is saved and the duration. Do not use a persistent saved draft on a shared device unless you understand who else can access that browser. You can use the interface’s clear-draft control where available, or clear the relevant browser storage. Your legal agreement and consent checkboxes must not be silently reselected from a saved draft.
The current storage inventory, including any enabled draft or preference storage, is shown here:
- bondora-reading-position-v1:[report/session/version] and enabled preference — Optional local storage. Only after Remember my place is selected: a non-authorizing report/session/version reference, chapter identifier, relative position and expiry. No question, report text, person name, authentication credential or AI copy is stored; text size and line spacing stay in memory. The choice and position are valid for up to 30 days from the explicit choice, bounded by the current access expiry. Reading does not renew that choice. Expired entries are ignored and removed on the next report opening; browser local storage has no automatic deletion timer while the site is closed. Turning the option off clears that report's entries; sign out or an account-access change clears all entries. An open page stops writes after expiry or account change. This preference neither proves report ownership nor extends purchased access.
- bondora_account_flow (or bondora_account_flow_[challenge ID]) — HttpOnly cookie. Browser-bound passkey or email sign-in challenge and brief recovery of its completed response. Up to 20 minutes from issuance: new verification expires after 15 minutes, while the same completed sign-in is recoverable for five minutes. The cookie alone cannot authenticate. Older named proofs are pruned as new challenges are issued. Sign out clears them.
- bondora_customer — HttpOnly cookie. Signed private customer identity for owned reports and membership; independent of payment email and optional analytics. 30 days from authorized issuance. Expiry is separate from paid service time. A saved passkey or verified email is required for automatic sign-in on another device; removing private access revokes customer sessions.
- bondora_preserved_gift — HttpOnly cookie. The original signed private gift session retained when signing in to another account, so an explicit Return to my earlier gift can restore that gift's access. It is an authentication credential, contains no report text, and does not transfer the gift to the signed-in account. Only until the original customer session expiry, at most 30 days from its original issuance. Returning to the gift or retrying a lost sign-in response does not extend it. Sign out or removal of browser private access clears it; expired, erased or revoked gift access is rejected by the server.
- bondora-one-page-draft-v1 — Tab session storage. Original draft, current answer, actual confirmations with document versions, and non-authorizing submission/report references. Until cleared or the browser discards the tab session. Session restoration can preserve it. Necessary private recovery, not optional analytics. Server validation is always required. Clear draft text and remove private access separately on shared devices.
- bondora_followup_pending:[reading ID] — Tab session storage. Non-authorizing request number for checking an uncertain follow-up; no question or answer is stored here. Until the answer is retrieved, the customer explicitly starts a different failed question, or the browser discards the tab session. Session restoration may preserve it; private reading authorization is always required.
These are the first-party mechanisms implemented in this candidate. Actual enabled functions determine which are issued; their technical lifetimes are not data-deletion promises. PayPal may use its own payment, security and fraud-prevention technologies after checkout is deliberately started. Its exact browser keys, purposes and durations, and deployed provider behavior, still require verification. No optional third-party analytics SDK is included in the current application.
The bondora_customer cookie authorizes the same private customer identity across that customer’s own topics. Its 30-day technical lifetime neither extends nor shortens a paid membership. Verification is required before restoring it on another device; a payment email or report URL alone is insufficient.
Optional passkey and email sign-in use a short-lived HttpOnly flow cookie, separate from the signed customer session. A passkey credential is managed by your device or credential provider; Bondora receives a public-key proof rather than your biometric data. Signing out clears the browser's Bondora private access cookies and local private state. It does not erase the passkey in your provider, delete server records or cancel purchased rights.
4. PayPal and other providers
When you choose to use PayPal, its checkout may load provider resources and use its own technologies for payment, security, and fraud prevention. PayPal has its own privacy and cookie information and may act independently for those activities. Choosing PayPal is not a general permission for unrelated advertising tracking by Bondora.
The active provider and purpose information appears in the storage inventory. We do not label all provider activity “necessary” merely because a provider supplies a payment or analytics tool. Where a particular activity requires a separate choice, the service must obtain that choice or avoid the activity.
5. Your controls
You can accept or reject optional analytics, change your choice later, or withdraw an earlier permission through Privacy Settings. Withdrawing permission stops future optional collection; it does not retroactively make earlier permitted processing unlawful. You may also request deletion where applicable.
A recognized Global Privacy Control signal is respected for any covered sale or sharing activity. Bondora additionally treats that signal as a reason to leave optional analytics off. We do not silently override the signal with an older saved preference. A legacy Do Not Track header is not the same mechanism.
Your browser can delete or block cookies and other storage. Blocking necessary reading-session storage may prevent private reading access. Clearing storage does not automatically delete database records or cancel a purchase. Contact real@realnova.world for an access problem or real@realnova.world for a privacy request.
6. Updates
We update this notice and the inventory when the active technology or purpose changes. We seek a new choice when a new purpose requires it rather than treating an old choice as unlimited permission.