Cookie Policy

Strictly necessary

These make the site do what you ask of it: remember your cookie choice and keep you signed in. They are set only when that happens, cannot be switched off in the cookie banner and need no consent (§ 25(2) No. 2 TDDDG). All of them are first-party, sent only to ngoradar.org, marked SameSite=Lax and, over https, Secure.

• ngr_signin_<id> (cookie) — protects a sign-in you have started: an encrypted record of its state, nonce and PKCE code verifier, and of the page to return to. Set when you press Sign in or Create account, sent only to ngoradar.org/auth and not readable by scripts (httpOnly). Deleted when the sign-in completes, and expires after 10 minutes at the latest. The <id> differs for each sign-in, and at most three are kept at once. Legal basis: Art. 6(1)(b) GDPR.
• ngr_session.0, ngr_session.1, ngr_session.2 (cookies) — keep you signed in. Together they hold, encrypted, the tokens issued by the Action Network Worldwide sign-in service and your account id, name and email address, split across up to three cookies because browsers limit the size of one. Not readable by scripts (httpOnly). They expire after 30 days and are deleted when you sign out; the sign-in service ends an unused session sooner. Legal basis: Art. 6(1)(b) GDPR.
• ngr_signed_in (cookie) — the value 1, so the page can show your marketplace and a Sign out button without first asking the server. It grants no access by itself. Readable by scripts; expires after 30 days and is deleted when you sign out. Legal basis: Art. 6(1)(b) GDPR.
• ngoradar-consent (local storage, not a cookie) — your cookie choice, with the date and time you made it and the version of this policy it was made against, so we do not ask on every page and can show that consent was given. Kept in your browser and never sent to a server. It stays until you clear your browser storage, and we ask again if this policy changes materially. Legal basis: § 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR together with Art. 7(1) GDPR.

Analytics — only if you accept

If you accept analytics in the cookie banner, ngoradar.org loads Google Analytics 4, provided by Google Ireland Limited. If you do not, the script is never loaded and neither cookie below is set. With your consent, a page view is recorded for each page you open; Google Analytics 4 does not log or store IP addresses. Google may process the data in the United States, relying on the EU–US Data Privacy Framework. Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. See https://policies.google.com/privacy.

• _ga (cookie) — tells one browser from another, so that visits can be counted. Expires after up to 2 years.
• _ga_<id> (cookie) — keeps the state of the current visit for this site's Google Analytics property; <id> is that property's measurement id. Expires after up to 2 years.

The sign-in service

Signing in or creating an account takes you to the Action Network Worldwide sign-in service, on its own site. The strictly necessary cookies it needs to carry out the sign-in are set there, not on ngoradar.org.

What we do not do

There is no advertising, no cross-site tracking and no live-chat widget on this site, and nothing is sold or shared with data brokers.

Managing your choice

Use “Cookie settings” in the site footer to change your choice at any time — withdrawing consent is as easy as giving it (Art. 7(3) GDPR). A withdrawal takes effect at once: Google Analytics stops, and the analytics cookies it set on ngoradar.org are deleted. You can also block or delete cookies in your browser settings; if you block the strictly necessary ones, signing in will not work. Declining analytics does not stop you reading the site or browsing opportunities.

Contact

Questions about cookies on this site? Email support@ngoradar.org.