Cookie & Storage Policy
This page is a public summary of Newel's cookie and storage practices. It describes the cookies, browser-storage items, offline caches, and the third parties most people encounter — on the public website and inside the application. The short version: one sign-in cookie, no ad trackers, no third-party analytics, and we never sell your data. The complete notice — including our Data Processing Addendum (DPA) governing how we handle your clients' and leads' personal information — is available in our full legal documentation.
Cookie & Storage Policy
This is the narrative version of how Newel — operated by Prime Edge LLC — uses cookies and browser storage. A section-by-section detail of the cookies, storage keys, and third parties you are most likely to encounter sits below, with a table of contents.
Newel is really two surfaces, and they behave differently. The public marketing site — the home, pricing, and legal pages, including this one — sets no cookies at all, relying only on a handful of small browser-storage preferences so it doesn't repeat itself to returning visitors. The application, the signed-in workspace where agents run their business, sets exactly one cookie and uses browser storage more heavily to keep a workspace responsive. Storage everywhere on Newel is first-party and functional; nothing here profiles you across other websites. A cookie is a small piece of text a site asks your browser to hold and resend; localStorage and sessionStorage do something similar but stay on your device and are never sent over the network automatically; a service-worker cache stores copies of the app's own files so it can load quickly and work offline.
The one cookie we set is vendora_session, created only after you sign in to the application. It is a signed, HttpOnly, Secure, SameSite=Lax token that proves to our server you are who you say you are, and it expires twelve hours after issuance or the moment you sign out, whichever comes first. That is the entire cookie inventory: the public site sets none, and we set no analytics, advertising, or social-media cookies anywhere on Newel.
Browser storage does more of the work. On the marketing site, a few localStorage keys remember that you dismissed the cookie banner or newsletter prompt, or hold a promo or referral code until you sign up — small conveniences that never leave your device. Inside the application, localStorage keys beginning with vendora hold your actual workspace: your remembered username and session profile, your CRM records (contacts, listings, tasks, campaigns, and activity), your theme and layout preferences, your profile and brokerage branding, and configuration for any optional integration you've turned on, such as Google Calendar or Zapier. None of it is advertising, and none transmits automatically — the app reads it locally and only sends data to our server when a feature you're using needs it, such as saving your CRM to your cloud account. A service worker also caches the app's own code under vendora- prefixed cache names so it opens fast offline; that cache holds application code only, never your personal information.
A small number of outside services can load in your browser while you use Newel, each chosen for function rather than tracking. Cloudflare Turnstile guards our sign-in and sign-up forms against automated attacks. Google's sign-in flow appears only if you choose to connect Google Calendar in Settings. Google Fonts serves our typefaces, and cdnjs delivers one open-source library used for exporting ZIP files. Stripe's hosted checkout processes payments without Newel ever seeing your card number. Listing photos may load from the sites that host them, the same way any embedded image would. Netlify, Supabase, Anthropic and OpenAI, fal.ai, Resend, and Stripe's backend work server-to-server only and never run code or set cookies in your browser; what each receives is covered in our Privacy Policy. We run no advertising cookies or pixels, no third-party analytics, and no cross-site or fingerprinting-based tracking, so Do Not Track and Global Privacy Control signals already match how we behave.
You stay in control throughout. Signing out immediately invalidates and removes the session cookie. Settings → data controls in the app lets you export or clear your workspace data, and disconnecting an integration deletes its stored configuration. Clearing your browser's cookies and site data wipes everything described above at once — though this signs you out, and for local-only workspaces it also permanently deletes data that exists only on your device. If your business stores personal information about your own clients inside Newel, our Data Processing Addendum — covering controller and processor roles, sub-processors, and breach notice — is part of the full legal documentation. This Policy, like our Privacy Policy and Terms of Service, is governed by the laws of the State of South Carolina. We will update this page, and never add a tracker silently, before any change takes effect; questions go to hello@newelos.com.
- Scope of this policy
- What "cookies and storage" means
- Cookies we set
- Storage on the public website
- Storage inside the application
- Offline cache (installable app)
- Third parties that may run in your browser
- Services that never run in your browser
- No advertising or tracking
- Your choices and how to clear data
- Changes to this policy
- Contact
Scope of This Policy
Newel has two parts and they behave differently:
- The public website (this marketing site, including the home, pricing, and legal pages). It sets no cookies at all and uses only a few small browser-storage preferences described in section 4.
- The application (the Newel workspace you sign in to). It sets one strictly necessary sign-in cookie and uses browser storage to run your workspace, as described in sections 3 and 5.
Everything in this policy is first-party and functional. Nothing here profiles you across other websites.
What "Cookies and Storage" Means
A cookie is a small piece of text a website asks your browser to keep and send back on future visits. localStorage and sessionStorage are related browser features that keep data on your device only — unlike cookies, they are never automatically sent over the network. A service-worker cache stores copies of the app's own files so it can open quickly and work offline. Newel uses all three, for function only.
Cookies We Set
Newel sets exactly one cookie, and only after you sign in to the application:
| Name | Purpose | Type | Lifetime | Protections |
|---|---|---|---|---|
vendora_session | Keeps you signed in. It holds a signed session token that proves to our server you are you. | Essential | 12 hours, or until you sign out | HttpOnly · Secure · SameSite=Lax · first-party only |
That is the complete list. The public website sets no cookies, and we set no analytics, advertising, or social-media cookies anywhere.
Storage on the Public Website
The marketing site keeps a few preferences in your browser's localStorage so it doesn't nag you twice. These never leave your device:
| Key | Purpose | Type | Lifetime |
|---|---|---|---|
vendoraCookieChoice | Remembers that you answered the cookie banner so it doesn't reappear. | Essential | Until you clear browser data |
vendoraNlSeen | Remembers that you dismissed the newsletter prompt. | Essential | Until you clear browser data |
vendoraNlEmail | If you sign up for updates, remembers the email you entered so the form doesn't re-prompt. | Functional | Until you clear browser data |
vendoraPromoCode / vendoraRefCode | If you arrived through a promo or referral link, holds that code so it can be applied if you sign up. Cleared after sign-up. | Functional | Until sign-up or cleared |
Storage Inside the Application
The Newel workspace is built to keep as much as possible on your own device. When you use the app, your browser's localStorage holds your working data and preferences under keys beginning with vendora. None of this is advertising — it is your workspace. By category:
| Category | Examples | What it holds | Lifetime |
|---|---|---|---|
| Sign-in & security | vendoraRememberedUser, vendora_user, vendoraTOSAccepted_* | Your remembered username (if you choose "remember me"), the signed-in profile for the current tab (sessionStorage — erased when the tab closes), and the record that you accepted the Terms of Service. | Session or until cleared |
| Workspace data | vendoraContacts, vendoraAgents, vendoraTasks, vendora_v2, vendoraContentCalendar, vendoraEmailCampaigns, vendoraActivityLog | Your CRM records: contacts, listings, tasks, lists, campaigns, content history, and activity. For cloud accounts this is a local working copy of data also stored (encrypted in transit, access-controlled) on our servers. | Until you delete it in-app or clear browser data |
| Preferences & appearance | vendoraTheme, vendoraSidebarCollapsed, vendoraSettingsTab, vendoraNotifPrefs_*, vendoraPinnedStates_*, vendoraTutorialDone_* | Theme, layout, notification preferences, pinned items, and which tutorials you've completed. | Until cleared |
| Profile & branding | vendoraProfileName_*, vendoraProfilePhoto_*, vendoraBrokerageLogo_*, vendoraBizProfile_* | Your display name, phone, profile photo, brokerage name/logo, and commission-split settings used to brand your marketing materials. | Until cleared |
| Integrations you enable | vendoraGoogleClientId, vendoraZapierWebhook, vendoraWebsyncConfigured | Configuration for optional connections you set up yourself (Google Calendar, Zapier, website sync). Created only if you turn the feature on. | Until you disconnect the integration or clear data |
localStorage and sessionStorage are never sent automatically to us or anyone else — the app reads them locally and only transmits data to our own server when a feature you use requires it (for example, saving your CRM to your cloud account).
Offline Cache (Installable App)
Newel can be installed to your device as an app. To make that work, a service worker keeps cached copies of the app's own files (the page shell, icons, and assets) in your browser's cache storage under names beginning with vendora-. This cache contains application code, not your personal data. Sign-in requests and your CRM data are explicitly never cached. Uninstalling the app or clearing site data removes the cache completely.
Third Parties That May Run in Your Browser
A small number of outside services can load in your browser while you use Newel. When any third-party resource loads, that provider necessarily receives your IP address and basic request details, and may set cookies on its own domain under its own policy. We chose each one for function, not tracking:
| Provider | Where it appears | Why we use it | Cookies? |
|---|---|---|---|
| Cloudflare Turnstile | Sign-in and sign-up forms | Verifies you are human and blocks automated attacks on accounts — without the puzzles of a traditional CAPTCHA. | May set its own functional cookies inside its widget. Cloudflare privacy policy |
| Google sign-in / Calendar | Only if you connect Google Calendar in Settings | Lets you link your Google Calendar (read-only) to see events inside Newel. Loads only after you click connect. | Google sets cookies on its own domains during sign-in. Google privacy policy |
| Google Fonts | All pages | Loads the typefaces this site uses. | No cookies; Google receives the font request (IP address). Google privacy policy |
| cdnjs (Cloudflare) | Application only | Serves one open-source code library (ZIP file handling for your exports). | Static file delivery; no tracking cookies. Cloudflare privacy policy |
| Stripe | Checkout and billing pages, hosted on stripe.com | Processes subscription payments. Card details go directly to Stripe — Newel never sees or stores them. | Stripe sets fraud-prevention and session cookies on its own pages. Stripe privacy policy |
| QR Server (api.qrserver.com) | Application only | Generates QR-code images on demand — for example, the QR code on an open-house sign-in kiosk or shareable listing link. The text you encode (such as a listing URL) is sent to the provider to produce the image. | Image delivery only; QR Server receives your IP address and the encoded text, and we embed no tracking scripts from it. QR Server (goqr.me) API |
| Listing photo hosts | Application only | Property photos in your workspace load from the sites that host them (your brokerage website, MLS/IDX content networks, stock-photo providers). Loading an image shares your IP address with that host, like viewing any web image. | Image delivery only; we embed no tracking scripts from these hosts. |
Maps: "View on map" buttons open Google Maps in a new tab — nothing from Google Maps is embedded in Newel itself, so no Maps cookies are set on our pages.
Services That Never Run in Your Browser
Newel's backend uses several processors that operate server-to-server only. They set no cookies and run no code on your device; they are listed here for completeness because they handle data for features you use:
- Netlify — hosts the website and application.
- Supabase — our database, where cloud-account data is stored with row-level security.
- Anthropic & OpenAI — power AI features (captions, descriptions, assistant). Content you submit to an AI feature is processed to generate the response.
- fal.ai (Seedance models) — powers AI image and walkthrough-video generation.
- Resend — delivers transactional and campaign email you send through Newel.
- Stripe — billing records and subscription state (in addition to its hosted checkout above).
Details on what each processor receives and your rights over that data are in the Privacy Policy.
No Advertising or Tracking
- No advertising cookies, pixels, or tags — first- or third-party.
- No third-party analytics (no Google Analytics, no Meta Pixel, no session-recording tools).
- No cross-site behavioral tracking and no fingerprinting for advertising.
- We do not sell or share your personal information for advertising purposes.
Because we don't use non-essential tracking, declining "non-essential" in the cookie banner changes nothing about how the site works — there is nothing to decline. The banner exists so that if this ever changes, your choice is already recorded and will be honored.
Your Choices and How to Clear Data
In the app:
- Sign out — immediately invalidates and removes the
vendora_sessioncookie. - Settings → data controls — export or clear your workspace data from within Newel.
- Disconnect integrations — removing a connection (Google, Zapier, etc.) deletes its stored configuration.
In your browser:
- Clear cookies and site data for this site to remove everything in sections 3–6 at once. Note this signs you out, and for local-only workspaces it permanently deletes data that exists only on your device.
- Browser settings can also block cookies entirely; the application requires the one essential cookie to keep you signed in, so blocking all cookies prevents sign-in.
Do Not Track / Global Privacy Control: Because Newel performs no cross-site tracking and sells no data, our behavior already matches what these signals request, whether or not your browser sends them.
Data Processing Addendum. If your business uses Newel to store personal information about your own clients, leads, or contacts, our complete Data Processing Addendum — covering controller/processor roles, sub-processors, international transfers, breach notice, and data-subject requests — is part of the full Cookie & Data-Processing Notice, not reproduced on this summary page.
Changes to This Policy
If we add a cookie, storage category, or third-party connection, we will update this page before the change takes effect, and material changes will be flagged in the app. We will never add advertising trackers silently.
Contact
Questions about cookies or storage: email hello@newelos.com, or review the Privacy Policy and Terms of Service.
⚠️ Not legal advice. This page is a factual, engineering-level inventory of cookies and storage. It does not create additional legal rights beyond those in our Terms of Service, Privacy Policy, and applicable law.