Section 1 of 15: Overview
Legal
Cookies, analytics, and every identifier we set
Two cookies and one localStorage key. This notice names all three, says what each one holds and how long it lasts, and tells you how to switch the whole thing off.
Scope
1What this notice covers
In shortThe three identifiers pixlnova.com puts in your browser, and nothing else.
Section 2 lists every identifier this site sets, with its type, lifetime, scope, contents and purpose. That list is complete. Nothing else on these pages writes to your browser.
1.1Who sets them
PixlNova is a sole proprietorship run by one person, who is also the person who answers the contact address. There is no analytics team and no separate data controller behind this site.
1.2Which properties it applies to
This notice describes the identifiers set by pixlnova.com. PixlNova also runs projects.pixlnova.com, which sells downloadable academic project packages, and freelancer.pixlnova.com, a talent marketplace with escrow. Those are separate products with their own terms and their own privacy and cookie notices, and this notice does not govern them.
One qualification, because it would be misleading to leave it out: the two cookies described below are scoped to the whole pixlnova.com domain, so they are readable on those subdomains too. Section 4 explains exactly what that does and does not mean.
1.3About the plain-English summaries
Each section carries a one-line summary. It is a reading aid, not a term of the notice: where a summary and the section it sits above differ, the section governs.
Across PixlNova's documents, three kinds of clause deliberately carry no summary — limitation of liability, indemnity, and assignment of intellectual property. A friendly one-liner on those three reliably understates what they do, and the mismatch is expensive precisely when it matters. This notice contains none of them, so every section here has one.
The complete list
2Every identifier, in full
In shortThree identifiers: two cookies and one localStorage key. This is all of them.
If an identifier is ever added, changed or given a longer life, this notice is updated and the change is published under section 12 before it takes effect.
2.1The table
| Identifier | Type | Lifetime | Scope | What it holds | Why |
|---|---|---|---|---|---|
| pxnv_anon_id | First-party cookie | 365 days from when it is set | Domain=.pixlnova.com — sent to pixlnova.com and to every subdomain | One opaque random value. No name, email, phone number or account is stored inside it. | Lets repeat visits from the same browser be counted as one visitor rather than as several. |
| pxnv_session_id | First-party cookie | 30 minutes, sliding — it is re-set on every page event, so it expires 30 minutes after your last activity, not 30 minutes after you arrive | Domain=.pixlnova.com — sent to pixlnova.com and to every subdomain | One opaque random value for the current visit. | Groups the pages you open in one sitting into a single session, so a visit reads as a visit rather than as five unrelated page views. |
| pxnv_first_touch | localStorage key — not a cookie | No expiry. It stays until you or your browser clears site data for this origin. | Origin-scoped. It is readable only by the origin that wrote it, and it is never attached automatically to a network request. | The UTM parameters, the referring URL and the landing path of your first visit. | Records how you first arrived, so that an enquiry sent weeks later can be attributed to the thing that actually brought you here. |
Scroll the table sideways for every column
2.2What the values are not
The two cookie values are random. They carry no meaning on their own: they are not derived from your name, your email address, your IP address or your device, and nothing can be read out of them. Whatever meaning they have lives in a database record that points at them, not in the cookie.
This notice documents each identifier's name, type, lifetime, domain scope, contents and purpose. If you need the full set of cookie attributes for a security review, ask using the contact block at the end and you will be sent them as they are actually configured.
2.3What is recorded against them
Page events: which page of this site was opened, when, and the referrer that led to it. Plus a hashed form of the connecting IP address, which section 7 describes in detail. Enquiry submissions are recorded separately and are covered by section 8 and by the privacy notice.
Mechanics
3Two are cookies. One is not.
In shortpxnv_first_touch is localStorage, not a cookie, and it behaves differently in ways that affect you.
3.1The practical difference
A cookie is attached by the browser to every request it makes to the matching domain, automatically. A localStorage key never leaves the browser unless page code reads it and deliberately sends it. pxnv_first_touch is only ever read at one moment: when you submit an enquiry.
3.2Why it has no expiry
localStorage has no expiry mechanism. A key written there stays until it is overwritten or the site's data is cleared. That is a property of the browser, not a retention decision, but the effect on you is the same, so it is stated plainly: pxnv_first_touch persists indefinitely until you remove it.
In most browsers the control that removes it is labelled "Cookies and other site data". A cookie-only cleaner, or an extension that manages cookies alone, will leave pxnv_first_touch behind.
3.3It is written once
The key holds your first visit, not your latest one. Arriving again later through a different campaign does not overwrite it. That is the point of the word first: it answers where someone originally came from, which is the question a small studio actually needs answered.
Cross-property
4Domain=.pixlnova.com, and what follows from it
In shortThe two cookies are the same cookies on every PixlNova subdomain. They never reach any other website.
4.1What the attribute does
Both cookies are set with Domain=.pixlnova.com. The browser therefore sends them to pixlnova.com and to every subdomain of it, including projects.pixlnova.com and freelancer.pixlnova.com. There is one pxnv_anon_id per browser across all PixlNova properties, not one per property.
4.2What that means in practice
A visit to this studio site and a later visit to the projects store are, to us, the same anonymous browser. That is deliberate. It is how an enquiry that lands on one property gets attributed to the article or advert on another property that actually caused it.
It also means the three properties are not separate as far as these two identifiers are concerned, even though they are separate as far as their contracts are concerned. Both statements are true and neither one cancels the other.
4.3What it does not mean
A cookie cannot be sent to a domain it is not scoped to. These cookies are never sent anywhere except pixlnova.com and its subdomains. No other website can read them, and they give PixlNova no visibility of anything you do on any site that is not ours.
4.4pxnv_first_touch is not shared this way
localStorage is scoped per origin, not per domain, and there is no equivalent of the cookie Domain attribute. pixlnova.com and projects.pixlnova.com therefore each hold their own separate pxnv_first_touch, and neither can read the other's.
Opt-out
5Do Not Track switches all of it off
In shortIf your browser sends Do Not Track, no identifier is written and no event is recorded.
5.1The check
The analytics code evaluates navigator.doNotTrack === "1" before it does anything else. When that is true it stops there: no cookie is set, no localStorage key is written, no page event is sent and no hashed IP is recorded. There is no reduced or anonymised mode — the path simply ends.
5.2You can check it yourself
- Turn on the settingIn your browser's privacy settings, enable the Do Not Track request if it offers one.
- Confirm the valueOpen the developer console on any page of this site and type navigator.doNotTrack. You are looking for the string "1".
- Reload and lookReload the page, then open Application, then Storage, and look for cookies named pxnv_anon_id or pxnv_session_id and a localStorage key named pxnv_first_touch.
- If any of them existThat is a defect, not a policy. Report it using the contact block at the end of this notice and it will be treated as one.
5.3The honest caveat
Only the exact string "1" disables tracking, because that is what the code compares against. Browsers report this inconsistently — some return "yes", some return "unspecified", some return null, and several have removed the setting entirely. If yours does not expose it, Do Not Track is not available to you here and section 10 is the reliable route instead.
Do Not Track is a signal your browser sends and this site chooses to honour. It is not a legal mechanism, and honouring it is a commitment made in this notice rather than one imposed by a regulator.
Absent by design
6What this site does not use
In shortNo advertising cookies, no third-party trackers, no cross-site profiling.
6.1Not present on these pages
- Advertising or retargeting cookies of any kind
- Third-party analytics scripts — the three identifiers in section 2 are first-party and are all there is
- Social network pixels or share-button trackers
- Cross-site profiling, audience building or lookalike modelling
- Sale, rental or sharing of this data with data brokers or advertising networks
- Any automated decision about you made from these identifiers
6.2Payment providers
PixlNova takes payment through Razorpay and Stripe. Where a payment is taken, it happens on the provider's own pages under the provider's own policy, including whatever storage that provider sets. This notice does not govern that, and it would be dishonest to imply it did. The subprocessors document lists who those providers are and what they receive.
6.3The /chat assistant
The guided assistant at /chat is a structured walk over content already published on this site. It is not a language model and it does not call one. It creates no identifier of its own — the same two cookies described in section 2 apply there and nothing more.
A brief submitted through /chat is not a chat log kept for training. It goes through exactly the same enquiry pipeline as the contact form, which means section 8 applies to it.
Pseudonymous
7Your IP address is hashed, not anonymised
In shortIPs are stored as a salted SHA-256 hash. That is pseudonymous personal data, and it is treated as personal data.
7.1What is stored
Each recorded event carries a SHA-256 hash of the string salt:ip, where ip is the address your request arrived from and salt is a secret value held by PixlNova. The raw address is not written to the database.
7.2Why that is not anonymity
A hash is not a disguise when the input space is small. There are only about four billion IPv4 addresses, and anyone holding the salt can hash a suspected address and check whether it matches a stored value. The hash therefore identifies indirectly. It is pseudonymised data, not anonymous data.
It follows that it is personal data under the Digital Personal Data Protection Act, 2023 and under the GDPR, and it is handled as personal data here. Policies that call this technique anonymisation are describing something the mathematics does not support.
7.3What that means for clearing cookies
The hash is derived from the network request, not from a cookie. Clearing your cookies removes the identifiers in section 2, but it does not remove hashes already recorded. A browser sending Do Not Track prevents the event from being recorded at all, which is the only mechanism that stops the hash existing in the first place.
The join
8When an anonymous identifier stops being anonymous
In shortSend an enquiry and the anonymous identifier is joined to your name and email address.
This is the section most cookie policies leave out. Until you contact us, the identifiers describe a browser. The moment you submit an enquiry, they describe you.
8.1What the enquiry form collects
Thirteen fields: name, email, phone, company, role or title, service, product stage, budget band, timeline, project description, reference URL, important requirements, and source.
8.2What is attached to it
At submission, the stored pxnv_first_touch value — the UTM parameters, referrer and landing path of your first visit — and the anonymous identifier are attached to the enquiry, so that the enquiry can be attributed to what actually produced it.
From that point the identifier is linked to an identified person. It stops being an anonymous counter and becomes part of your enquiry record, governed by the privacy notice, with the retention and access rights set out there.
8.3If you would rather it did not happen
- Clear this site's data before you submit — there is then no first-touch value and no prior identifier to attach.
- Or write to the contact address directly instead of using the form. An email carries none of this.
- Or browse with Do Not Track on, in which case none of it was ever recorded.
None of these routes changes the reply you get. Attribution exists so a one-person studio can tell which of its own pages are worth keeping, not to price you differently.
Location
9Where this data is stored
In shortIn a Supabase Postgres database in Sydney. If you are in India, that is outside India.
9.1The region
9.2Stated plainly for Indian users
If you are in India, the personal data described in this notice is stored outside India, on servers in Australia. That is a fact about the deployment, not a technicality, and you should know it without having to infer it from a region code.
The Digital Personal Data Protection Act, 2023 permits transfer outside India except to countries the Central Government restricts by notification. If Australia were ever restricted, this arrangement would have to change and this notice would change with it.
9.3Who else sees it
The analytics records are read by the founder. The infrastructure providers that hold or transmit them are listed in the subprocessors document, which is the single place that list is maintained so it cannot drift out of step across documents.
Control
10How to clear or block them, and what breaks
In shortClear site data, block cookies for this domain, or use Do Not Track. Nothing on this site stops working.
10.1Your options
- Clear site data for pixlnova.comIn your browser's privacy settings, find the entry for pixlnova.com and remove its cookies and site data. This removes both cookies and pxnv_first_touch together. A cookie-only cleaner leaves pxnv_first_touch in place.
- Block cookies for this siteAdd pixlnova.com to your browser's block list. The two cookies are then never stored, so every page load looks like a first visit.
- Turn on Do Not TrackNothing is written and nothing is sent. See section 5, including the caveat about browsers that no longer offer the setting.
- Use a private windowEverything described here is discarded when you close it. Nothing survives the session.
- Block third-party cookiesHas no effect here, because no third-party cookie is set. Listed so you know it is not the control you are looking for.
10.2What breaks on this site
Nothing. None of the three identifiers logs you in, holds a preference, secures a form or gates any content. Every page, the pricing, the enquiry form and the /chat assistant work identically without them.
What is lost is on our side, not yours: your repeat visits count as separate visitors, and an enquiry arrives without knowing what first brought you here.
10.3One caveat if you hold an account elsewhere on the domain
Blocking cookies across the whole of pixlnova.com is broader than blocking them for this site. projects.pixlnova.com and freelancer.pixlnova.com set their own operational cookies for sign-in, downloads and escrow under their own notices, and a blanket block on the domain can sign you out of those. Blocking or clearing at the level of this specific site avoids that.
Open question
11Consent, legal basis, and what is still unsettled
In shortThere is no consent banner today. Here is the reasoning, and the part a lawyer still has to settle.
11.1The position today
This site does not show a consent banner. The reasoning: the identifiers are first-party, they exist only to count visits and attribute enquiries, they are not used for advertising or cross-site profiling, they are listed here in full, and a browser signalling Do Not Track is excluded entirely.
11.2What that reasoning does not settle
In the EU and the UK, the rules on storing or reading information on a device generally require consent for anything beyond what is strictly necessary to provide the service you asked for, and analytics is usually not strictly necessary. Under the DPDP Act, notice and consent obligations attach to the processing of digital personal data. Neither point is resolved by the fact that the tracking here is modest.
This is the specific question the legal review of this notice has to answer. If the answer is that a consent mechanism is required, one will be added and this notice will change under section 12 rather than quietly.
This is written down rather than left out because a reader deciding whether to trust a draft is better served by knowing where its author thinks the weak point is.
11.3Asking for deletion
You can ask for the analytics records tied to you to be deleted, using the route in the contact block at the end of this notice.
One practical point, because it saves a round of email: if you have already cleared your cookies, the identifier no longer exists on your side and there is nothing to match a request against. Include the email address you used for any enquiry, and the enquiry record and everything joined to it can be found and removed.
Changes
12How this notice changes
In shortMaterial changes are published 30 days before they take effect. Clarifications are immediate.
12.1What counts as material
- Adding an identifier, or adding a purpose to an existing one
- Extending a lifetime — for example moving pxnv_anon_id beyond 365 days
- Widening the domain scope of any identifier
- Changing where the data is stored, including the storage region
- Adding a recipient, or introducing any third-party script that sets storage
- Weakening or removing the Do Not Track behaviour in section 5
A material change is published at least 30 days before it takes effect, and the version and effective date at the top of this notice change with it.
12.2What counts as a clarification
Wording, typos, and clearer explanations of something that was already true and already in effect. These take effect immediately. They are still recorded in the version history, so a reader can see that something moved and judge for themselves whether the label was fair.
12.3What the review date means
The last-reviewed date at the top means a person read this notice on that date and checked each identifier, lifetime and scope against what the code actually sets. It is not the date a build ran.
Contact
Who to write to
Everything below reaches the same person. There is no ticket queue and no account manager.
Grievance redressal
If a complaint is not resolved within 30 days, or you are not satisfied with the outcome, the full escalation route — including your statutory options — is set out on the grievance page.
Changes