01Summary
- Nodaform itself creates only one strictly necessary cookie: the session cookie created when you sign in. Cloudflare's bot protection and the Google sign-in window may set their own strictly necessary cookies (below). Your preferences and a temporary copy of your projects are kept in your browser's local storage (localStorage).
- Meta Pixel, Google Analytics and Google Ads, used to measure the results of our advertising and how the site is used, run only if you give consent in the cookie banner; if you don't, they are never loaded. For visitor statistics we use Cloudflare Web Analytics, which does not use cookies (aggregate statistics such as page view counts; it does not identify you or create any record in your browser).
- You can change your preference at any time:
- Fonts, including Arabic and Japanese, are loaded from our own server; no external font service such as Google Fonts is used.
- You may delete the entries in your browser at any time. Your projects are not lost, as they are stored in your account; only the most recent changes made while offline and not yet transmitted may be lost.
02What are cookies and local storage?
A cookie is a small text file that a website you visit stores in your browser and that is sent back to the server with subsequent requests.
Local storage (localStorage) is a similar technology that allows a website to store data in your browser. Unlike cookies, the data is not sent to the server with every request and remains on your device until you delete it. Session storage (sessionStorage) works in the same way, but is deleted when the browser tab is closed.
In this policy, the term “entry” covers all of these technologies. Entries can be read only by nodaform.com; other websites cannot access them.
03Categories we use
| Category | Description |
|---|---|
| Strictly necessary | Required for the Service to function: session, account, projects and functions you have expressly requested (sharing, support, drawing sheets). Without these entries, the editor and account functions do not work. |
| Functional | Remembers choices you make, such as language, region and display. If deleted, the Service continues to function; only your choices revert to their defaults. |
| Marketing | Meta Pixel and Google Ads: measure how many visits, sign-ups, first plans and purchases our ads bring. They are activated only with your explicit consent in the cookie banner; you can withdraw your consent at any time. |
| Analytics | Cloudflare Web Analytics, which does not use cookies: aggregate statistics such as page view counts; it creates no record in your browser and does not identify you. Google Analytics: measures which pages are visited and where visitors come to the site from; because it uses cookies, it is activated only with your explicit consent in the cookie banner. |
04Entries kept in your browser
The list below contains all entries the site may create in your browser. An entry is created only when you use the relevant function; for example, if you have never saved a sheet template, the qwall.sheets.v1 entry will not exist.
| Switch | What it stores | Category | Duration |
|---|---|---|---|
| Cookie | |||
nf_sess | Session cookie: a random key that informs the server that you are signed in; on its own, it contains no personal information. It cannot be read by scripts on the page (HttpOnly), is sent only over secure connections (Secure) and is not attached to requests originating from other sites (SameSite). | Strictly necessary | 30 days from sign-in; deleted when you sign out |
nf_admin | Site administrators only: admin panel session. Sent only to administration addresses; cannot be read by scripts on the page. | Strictly necessary | 12 hours; deleted when you sign out |
__cf_bm, cf_clearance | Cloudflare bot protection: Cloudflare sets it when needed to verify that your browser is not a bot; it has nothing to do with your content. | Strictly necessary | 30 minutes; cf_clearance up to 1 year |
g_state | Only when you open the sign-in window: the state of the Google sign-in button (e.g. that the window was closed). Set by Google's library. | Strictly necessary | Duration set by Google |
_fbp | Only if you have consented to Meta Pixel: a random identifier by which Meta recognizes your browser for ad measurement. | Marketing | 90 days |
_fbc | Only if you have given your consent and arrived at the site by clicking a Meta ad: the click identifier. | Marketing | 90 days |
_ga, _ga_* | Only if you have consented: a random identifier and session information by which Google Analytics distinguishes visits from one another. | Analytics | Duration set by Google (up to 2 years) |
_gcl_au, _gcl_aw | Only if you have consented: identifiers by which Google Ads matches a visit from an ad with a later sign-up or purchase; _gcl_aw is only set if you came to the site by clicking a Google ad. | Marketing | 90 days |
| Account and session | |||
qwall.session.v1 | A copy of non-sensitive information about the signed-in user, such as name, email address, plan and subscription period, so that pages load quickly. The actual session is held in the cookie and is verified with the server each time the site is opened. | Strictly necessary | Until you sign out |
| Projects and content | |||
qwall.plan.v1 | A temporary copy of the plan currently open in the editor. | Strictly necessary | Until you sign out |
qwall.projects.v1 | A temporary copy of your projects for fast loading (plan data, name, date). The primary record is stored in your account. | Strictly necessary | Until you sign out |
qwall.projects.owner | Records which account the temporary copies belong to; if a different account signs in on the same browser, the copies are deleted. | Strictly necessary | Until you sign out |
qwall.sync.dirty.v1 | A list of changes made while offline that have not yet been sent to your account. | Strictly necessary | Deleted once sent or when you sign out |
qwall.sync.inflight.v1 | A record of the change currently being sent to your account, so that if the connection drops partway, the change is not lost and is sent again. | Strictly necessary | Deleted once sent or when you sign out |
qwall.sheets.v1 | Your drawing sheet templates: paper size, scale, title block rows, company name and the logo you uploaded. | Strictly necessary | Persistent — until you delete it |
qwall.customfurn.v1 | The custom furniture and objects you have created. | Strictly necessary | Persistent — until you delete it |
qwall.bimmat.v1 | The materials you have added to the BIM material library. | Strictly necessary | Persistent — until you delete it |
qwall.newplan | Passes the new plan settings you selected on the My account page to the editor. | Strictly necessary | Temporary — deleted when the editor opens |
nf.mob | sessionStorage: when you preview the phone view on a computer (with ?mob=1 in the address), it remembers this choice for the duration of the tab. | Functional | Until the tab is closed |
qwall.guest | sessionStorage: the ID of a plan shared with you that you opened via an invitation link, together with the invitation key, so that the plan reopens when the page is refreshed. The plan opens only after you sign in with the invited email address. | Strictly necessary | Until the tab is closed |
nf.teamInvite | sessionStorage: the invitation key when you arrive through a team invitation link, so that the window for joining the team opens once you sign in or create an account. | Strictly necessary | Deleted once you join or when the tab is closed |
nf.giftCode | sessionStorage: the gift code, when you arrive via the link in a gift email, so that the window for using the code opens when you sign in or create an account. | Strictly necessary | Deleted when the code is used or the tab is closed |
| Preferences | |||
nf.consent | Your choice in the cookie banner (whether you allowed Meta Pixel and Google) and the date of the choice; so that the banner does not reappear on every page. | Strictly necessary | Persistent — until you delete it |
qwall.lang | The interface language you selected. | Functional | Persistent — until you delete it |
qwall.region | Your choice of region and currency for displaying prices. | Functional | Persistent — until you delete it |
qwall.country | The last known two-letter code of the country you are in (e.g. TR), used to determine the pricing region. | Functional | Persistent — until you delete it |
qwall.billing | Your choice of monthly or yearly view on the pricing page. | Functional | Persistent — until you delete it |
qwall.tour | Records whether you have completed or skipped the editor introduction tour. | Functional | Persistent — until you delete it |
nf.rnd.ratio | The ratio you select for the render frame (16:9, 4:3, 1:1 or 3:4). | Functional | Persistent — until you delete it |
nf.rnd.frame | Whether the render frame outline is switched on or off. | Functional | Persistent — until you delete it |
qwall.flow | The tab you selected on the “How It Works” page. | Functional | Persistent — until you delete it |
nf.fsTip | Remembers that the “Full screen” tip has been shown on a phone, so that it does not appear again. | Functional | Persistent — until you delete it |
nf.fireRegion | The region tab you chose on the fire safety page. | Functional | Persistent — until you delete it |
nf.accRegion | The region tab you chose on the accessible design page. | Functional | Persistent — until you delete it |
nf.pngLy | The drawing layers you selected when taking a snapshot (PNG) in the editor, so that the same selection comes up next time. | Functional | Persistent — until you delete it |
nf.scSeen | That you have seen the scroll hint on sideways-scrolling tab strips, so that the hint does not play again. | Functional | Persistent — until you delete it |
nf.siteMode | The plot drawing mode (point by point or rectangle) you chose in the Site step of the editor. | Functional | Persistent — until you delete it |
nf.trialEnd.<date> | Remembers that the notice about the end of the campaign trial period has been shown, so that it does not appear again. | Functional | Persistent — until you delete it |
qwall.announce.dismissed | The site announcement you dismissed, so that the same announcement is not shown again. | Functional | Persistent — until you delete it |
| Site settings (cache) | |||
qwall.announce.<lang>, qwall.announce.until.<lang> | The last known copy of the site-wide announcement text for each language, together with its end time, so that the page loads quickly (contains no personal data). | Strictly necessary | Persistent — until you delete it |
qwall.pricing.v1 | The last known copy of the regional price table, so that prices are displayed quickly (contains no personal data). | Strictly necessary | Persistent — until you delete it |
The “qwall” prefix in the key names is the product’s internal code name. Share links, comments and support tickets are not stored in the browser; they are stored on the server together with your account.
05Third-party services
| Service | When and what is transferred |
|---|---|
| Cloudflare static.cloudflareinsights.com, challenges.cloudflare.com | Visitor statistics without cookies on every page (Web Analytics): aggregate information such as page address, browser type and load time; your IP address is not stored in the statistics. Bot check in the sign-up and forgot-password windows (Turnstile): your IP address and browser signals are transmitted to Cloudflare to verify that you are not a robot. Cloudflare bot protection may set the strictly necessary cookies above when needed. |
| Meta Pixel connect.facebook.net, facebook.com | Loaded only if you choose Accept in the cookie banner. To measure the results of our advertising, the address of the page you visit, your IP address, browser information, Meta’s cookie identifier and the following events are transmitted to Meta Platforms Ireland Ltd.: page view; sign-up and the method by which the account was created (email or Google); saving of the first real floor plan; opening of the payment window and a completed purchase (amount, currency, and the subscription plan and billing period purchased or the render credit pack, e.g. “pro-monthly”). Meta Pixel’s automatic events are also enabled: Meta may also collect data about the buttons you click on the page and page information such as the page title and description. Meta’s Automatic Advanced Matching feature may transmit to Meta the name and email address you type into forms on the site, hashed one-way in your browser, in order to match events with your Meta account; the plain values are not sent. Your floor plans and password are not sent. Meta may also process this data on its servers in other countries, including the United States, and is subject to its own privacy policy. |
| Google Analytics and Google Ads googletagmanager.com, google-analytics.com, googleadservices.com, doubleclick.net, google.com, googlesyndication.com | Loaded only if you choose Accept in the cookie banner. To measure how the site is used and the results of our advertising, the address of the page you visit, your IP address, browser and device information, Google’s cookie identifiers, the ad click identifier and the following events are transmitted to Google Ireland Ltd.: page view, sign-up, saving of the first plan, opening of the payment window, and the amount, currency and transaction number of a completed purchase. Your floor plans, password, name and email address are not sent. Google may also process this data on its servers in other countries, including the United States, and is subject to its own privacy policy. |
| Sign in with Google accounts.google.com | Loaded only on the sign-in screen and only when Sign in with Google is enabled. Google may use session cookies on its own domain. These cookies are subject to Google’s privacy policy. |
During payment, our online reseller Paddle may use cookies and measurement scripts (e.g. public.profitwell.com) in the checkout window for security and fraud prevention purposes; these are subject to Paddle’s policy.
06Legal basis and consent
Strictly necessary records are required for the performance of the contract we have concluded with you and for the provision of the service you have expressly requested (KVKK (Turkish Personal Data Protection Law) Art. 5/2-c). Functional records are created solely to remember a choice you have made and are based on our legitimate interest (KVKK Art. 5/2-f). Accordingly, in line with the Personal Data Protection Authority’s Guide on Cookie Practices and the “strictly necessary” and “requested by the user” exemptions under the EU ePrivacy rules, separate consent is not requested for these records.
Meta Pixel, Google Analytics and Google Ads are based on your explicit consent (KVKK Art. 5/1; Art. 9 for transfers abroad). If you choose Essential only in the cookie banner, they are not loaded. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing.
07How can you delete these records?
Your account and projects are stored on our servers; clearing site data does not delete them. Only the session and cache records in this browser are removed, so you will need to sign in again. Recent changes that have not yet been saved to the server may be lost; before clearing, make sure your open project has been saved.
Deleting Nodaform data only
- Chrome / Edge: click the site icon in the address bar › Site settings (Permissions for this site in Edge) › Delete data.
- Firefox: the lock icon in the address bar › Clear cookies and site data.
- Safari (macOS): Safari › Settings › Privacy › Manage Website Data › nodaform.com › Remove.
- Mobile browsers: delete the nodaform.com entry under Site settings or Website data in your browser settings.
Menu names may vary depending on the browser version.
Deleting individual records
In desktop browsers, you can open the developer tools with F12 and delete records individually under Local Storage › https://nodaform.com in the Application tab (Storage in Firefox). For example, deleting only the qwall.lang record resets your language choice without affecting your projects.
Deleting from your account
The Delete account action under My account › Settings permanently deletes your account and projects from our servers and removes the session record from this browser. Signing out only ends your session.
Blocking third-party requests
You can block the third-party requests above with browser extensions; some functions of the Service (e.g. the bot check, Google sign-in) may then not work. No extension is needed to turn off Meta Pixel and Google: it is enough to set your cookie preference to Essential only.
08Changes and contact
When the records used on the site change, this policy is updated and the date at the top of the page is revised. You may send any questions to info@nodaform.com. Detailed information on the processing of your personal data is provided in the KVKK Privacy Notice.