Cookie & Anti-Tracking Policy
1. Zero Behavioral Tracking Principle
Natrium operates an ad-free, surveillance-free email platform. We do not use advertising cookies, cross-site retargeting pixels, Google Analytics, Meta/Facebook pixels, Mixpanel, Hotjar, or any third-party behavioral telemetry scripts. Because we only use strictly necessary security and session storage tokens (exempt under GDPR ePrivacy Directive Art. 5(3)), we never clutter your screen with deceptive cookie consent banners.
2. Strictly Essential Storage Inventory
The following cookies and local storage tokens are strictly essential to authenticate your session, enable multi-account switching, defend against brute-force attacks, and preserve your interface preferences:
| Identifier | Type | Provider | Purpose | Lifespan |
|---|---|---|---|---|
| natrium_session | HttpOnly, SameSite=Lax Cookie | Natrium | HMAC-SHA256 signed session token authenticating your active mailbox session. | 24 Hours |
| cf_clearance | HTTP Cookie | Cloudflare | Edge DDoS protection and Turnstile human challenge verification proof. | Session / 30 Min |
| natrium_device_id | HTTP Cookie / LocalStorage | Natrium | Pseudonymous randomized nonce generated locally to rate-limit login abuse and prevent automated credential stuffing. Contains zero hardware, canvas, or browser fingerprinting telemetry. | 30 Days |
| natrium_linked_accounts | Browser LocalStorage | Natrium Client | Stores HMAC-signed account switcher tokens on your device for instant multi-mailbox switching. | Until Sign-Out |
3. LocalStorage vs. Cookie Isolation
We strictly isolate client-side localStorage from network cookies. Your UI preferences, reading pane layout, draft autosave states, and linked-account switcher metadata remain purely inside your local browser storage and are never automatically transmitted in background HTTP request headers.
4. Self-Hosted Assets & Zero External CDN Beacons
Unlike conventional web apps that load fonts, icons, and scripts from third-party CDNs (allowing external providers to set tracking cookies or log your IP address via Referer headers), Natrium serves all web fonts (Inter and JetBrains Mono), stylesheets, and SVG vector graphics (/Natrium.svg) directly from our first-party origin.
5. Inbound Email Spy Pixel & Tracker Stripping
External commercial senders routinely embed hidden 1x1 tracking pixels, invisible web beacons, and fingerprinted tracking links inside HTML emails to detect when, where, and on what device you open an email. Natrium's inbound sanitization engine automatically strips known spy pixels, blocks third-party cookie injection inside email bodies, and neutralizes tracking scripts before any message is rendered in your inbox.
6. Global Privacy Control (GPC) & Do-Not-Track Compliance
Natrium natively honors browser-level privacy signals including Global Privacy Control (Sec-GPC: 1) and Do-Not-Track (DNT: 1). Because our platform conducts zero cross-context behavioral tracking by default, every user automatically receives maximum anti-tracking protection whether or not those headers are enabled.
7. Managing Browser Storage & Cookie Controls
You can clear your cookies and localStorage at any time by clicking Sign Out in the application or through your browser's developer tools. Please note that disabling first-party HttpOnly cookies entirely will prevent the natrium_session authentication token from persisting across page reloads.
8. Policy Updates & Privacy Contact
Any updates to our storage inventory will be documented on this page with an updated enactment date. For questions regarding cookies, browser storage, or anti-tracking protections, contact privacy@natrium.sh.