Cookie and consent policy

Where you are changes when advertising loads

In the EEA, United Kingdom, and Switzerland, neither Google Analytics nor Adsterra is requested until you allow the matching category. Declining or not answering means no ad request and no analytics tag.

Elsewhere, including Canada and the United States, eligible public content pages may load Adsterra before you choose. Decline or turn Advertising off to opt out; if an Adsterra script already ran, the page reloads without it. Google Analytics remains opt-in everywhere.

A strictly necessary first-party cookie named ai-stats-ad-region stores only strict or open for one day. It is derived from the request country and contains no identifier or precise location.

Separately, loading any page with ?nss_ads=off writes a first-party cookie named nss_ads_optout, and no advertising is requested in that browser afterwards. It is scoped to novusstreamsolutions.com, so a single visit covers every Novus site; ?nss_ads=on removes it. We use it to keep our own browsing out of the advertising figures, and it is available to you for the same purpose. It is not a substitute for the Advertising category, which continues to work exactly as described above.

The four categories in detail

Each category is independent. Granting analytics does not grant advertising, and withdrawing one does not withdraw the other.

• Necessary: the Better Auth session cookie that keeps you signed in, request-origin and CSRF protection, and the one-day ai-stats-ad-region rule cookie. Auth cookies are HTTP-only, SameSite=Lax, and Secure in production. Your consent decision itself is stored in local storage under ai-stats-consent-v1, so it never travels with a request and there is no server-side copy of it.
• Functional: one first-party cookie, nss_ads_optout, and it is written only when you explicitly ask for it by loading a page with ?nss_ads=off. It holds the single character 1, no identifier and nothing about you, lasts two years, is SameSite=Lax and Secure, and is scoped to novusstreamsolutions.com so one visit covers every Novus site. Its only effect is to stop advertising being requested, so it reduces processing rather than enabling any; ?nss_ads=on removes it. Your theme and reduced-motion choices are kept in local storage on your device, are never sent to the server, and are not read by any third party.
• Analytics: Google Analytics 4, and nothing else. It loads only after you allow it, and it then runs across the whole site including signed-in pages. It receives page addresses, referrers, device and browser characteristics, and an approximate location that Google derives from your IP address. Because it runs on signed-in pages, a page address can contain the identifier of one of your sessions, projects, or share links. It never receives imported prompts, responses, transcripts, session titles, or project names.
• Advertising: Adsterra, limited to eligible public content pages. Signed-in analytics screens, legal and consent pages, security and accessibility pages, the API, and public share pages carry no ad code at all. In strict regions this category must be granted first; elsewhere it is the explicit opt-out switch.

Changing or withdrawing consent

Your choice is stored and can be changed at any time from the Cookie settings control in the site footer, and from Settings inside the app. Withdrawing is exactly as easy as granting: the banner has a Reject non-essential button alongside Accept all, with equal prominence.

Withdrawing advertising consent prevents further Adsterra loading and reloads the current page if an ad script already ran, ensuring previously injected ad content is removed. Withdrawal cannot delete information a third party already received. Analytics withdrawal immediately denies both Google Analytics destinations, expires applicable Google measurement cookies, and reloads once when the tag has already run; data Google already collected remains governed by Google's retention settings.

Browser controls work too. Global Privacy Control overrides a stored Google Analytics grant; blocking third-party cookies, using private browsing, or clearing site data also reduce or eliminate optional tracking. Clearing site data removes the stored consent decision and the session cookie, so the banner returns and you will be signed out.

Third parties involved

Google provides opt-in Google Analytics 4. Adsterra provides advertising and may use cookies or similar technologies for selection, frequency control, measurement, and fraud prevention. Ad units are labelled as sponsored and kept away from navigation and interface controls. Google AdSense and Infolinks are not loaded.

There is no session-replay, heatmap, fingerprinting, or social embedding service on the site, and no product analytics SDK. Vercel Analytics and Vercel Speed Insights were removed from the product on 31 July 2026, along with their origins in the site's content security policy, so no page-performance beacon is sent either. Hosting still produces ordinary server request logs, which are not cookies and are not a consent category. If any of that changes, this page and the consent categories change with it before the code ships.