1. How cookies are used
Cookies are small values stored by your browser and sent back to the relevant website. Grantnivo uses first-party cookies for session security, recording your privacy choice and, only if you enable it, measuring visits and opportunity engagement. We do not use a third-party advertising tracker in the current application.
The Privacy Policy explains the associated server records, purposes, retention and rights. Cookie duration describes browser storage, not how long every server log, backup or database record is retained.
2. Necessary cookies
- Session cookie (normally
grantnivo-session): maintains the website session, staff sign-in and form feedback. The name depends on deployment configuration. The configured session lifetime is 120 minutes and may refresh with activity. XSRF-TOKEN: supports protection against forged form requests. It is associated with the session; it is not an advertising identifier. Its visibility to JavaScript is intentional so protected requests can supply the token.grantnivo_analytics: remembers an accepted or declined analytics choice for up to one year. Both choices are stored so we can respect your selection without asking on every page. This cookie records the choice; it is not the visitor measurement identifier.
Necessary cookies are used to deliver the requested functionality, rather than being an optional marketing choice. You can block them in your browser, but sign-in, preferences or form security may then stop working. Hosting infrastructure can have additional security cookies; these must be documented by the operator if introduced.
3. Optional analytics
When you enable analytics, grantnivo_visitor stores a randomly generated visitor identifier for up to one year. The server uses keyed hashes of visitor and session identifiers to count visits and opportunity views/outbound clicks. It does not add your waitlist name or email to analytics events. This is pseudonymous measurement, not a guarantee of anonymity.
Before you opt in, and after you decline, the application does not set a new visitor cookie or write optional visit/click events. Necessary logs and security processing can still occur. Do Not Track and Global Privacy Control request headers override an accepted choice for application analytics. Staff and recognized bots are excluded.
Declining removes the optional visitor cookie through this browser and stops future optional events. It does not erase past database events or preferences on another browser. Use the Privacy Policy contact process for questions about historical data.
4. Change your preferences
Current choice: Necessary cookies only.
This choice is independent of joining the waitlist. Either option lets you browse opportunities and use the signup form.
5. Browser controls and external resources
You can inspect, delete or block cookies through your browser. Removing this site’s preference cookie resets the app to necessary cookies only until you choose again. Private-browsing sessions, another device or another browser can have different choices. Blocking all storage may prevent a saved preference from persisting.
Optional analytics preferences do not prevent requests to servers needed to deliver the page, externally hosted legacy images/fonts or external funder pages you choose to open. Those providers may receive technical request information and operate under their own policies. The operator should review additional embedded tools before introducing them; this choice does not pre-authorise future tracking technologies.
6. Questions and changes
This Cookie Policy was updated on 31 August 2026. We will update it when storage purposes or technologies materially change and seek new consent where required. For broader data questions, read the Privacy Policy.
For support, privacy questions, access/correction/deletion requests, waitlist withdrawal, complaints or concerns about these policies, email support@grantnivo.com. Use “Grantnivo privacy” or “Leave waitlist” as the subject and contact us from the address you registered with where possible. Do not send identity documents or sensitive beneficiary information unless we explain why a limited verification step is necessary.