Cookie Policy

Strictly necessary

These make the site do what you ask of it: remember your cookie choice, keep you signed in, offer you sign-in when you come back, and keep the service available. They are set only when that happens, cannot be switched off in the cookie banner and need no consent (§ 25(2) No. 2 TDDDG). All are scoped to ngoradar.org and, over https, Secure. The ones we set ourselves are also marked SameSite=Lax; __cf_bm is set for us by our content delivery network and is marked SameSite=None, which is described in its entry below.

• ngr_signin_<id> (cookie) — protects a sign-in you have started: an encrypted record of its state, nonce and PKCE code verifier, and of the page to return to. Set when you press Sign in or Create account, sent only to ngoradar.org/auth and not readable by scripts (httpOnly). Deleted when the sign-in completes, and expires after 10 minutes at the latest. The <id> differs for each sign-in, and at most three are kept at once. Legal basis: Art. 6(1)(b) GDPR.
• ngr_session.0, ngr_session.1, ngr_session.2 (cookies) — keep you signed in. Together they hold, encrypted, the tokens issued by the Action Network Worldwide sign-in service and your account id, name and email address, split across up to three cookies because browsers limit the size of one. Not readable by scripts (httpOnly). They expire after 30 days and are deleted when you sign out; the sign-in service ends an unused session sooner. Legal basis: Art. 6(1)(b) GDPR.
• ngr_signed_in (cookie) — the value 1, so the page can show your marketplace and a Sign out button without first asking the server. It grants no access by itself. Readable by scripts; expires after 30 days and is deleted when you sign out. Legal basis: Art. 6(1)(b) GDPR.
• ngr_member (cookie) — the value 1, set when you sign in, so that when you come back signed out the site offers you Sign in first rather than a free trial. It holds no account id or other personal data and grants no access. It is not deleted when you sign out, because remembering that this browser has an account is its purpose; delete it in your browser settings if you share this device. It is deleted when you delete your account, since there is then no account to sign in to. Readable by scripts; expires 365 days after your last sign-in. Legal basis: § 25(2) No. 2 TDDDG.
• ngr_in_app (cookie) — the value 1 or ios, set only when a page is opened from the NGOradar mobile app's in-app browser, so that the pages you open there show their content without the site's menus, offers or cookie banner. It holds no personal data and grants no access. Not readable by scripts (httpOnly). A session cookie, with no expiry date: it is deleted when that in-app browser ends its browsing session, and it is set again each time the app opens one of these pages. Legal basis: § 25(2) No. 2 TDDDG.
• ngr_pass_device (cookie) — a random value, set only when you open a private preview link to an opportunity (an address ending in ?pass= and a code), so that the link keeps working in the browsers it was opened in and stops once it has been opened on more devices than it allows. It is not derived from you, your device or your address, and it is not linked to an account; the Action Network Worldwide service that issued the link stores only a one-way hash of it, next to that link. Not readable by scripts (httpOnly). It expires after 60 days. Legal basis: § 25(2) No. 2 TDDDG — it is strictly necessary to show you the preview you opened.
• ngoradar-consent (local storage, not a cookie) — your cookie choice, with the date and time you made it and the version of this policy it was made against, so we do not ask on every page and can show that consent was given. Kept in your browser and never sent to a server. It stays until you clear your browser storage, and we ask again if this policy changes materially. Legal basis: § 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR together with Art. 7(1) GDPR.
• __cf_bm (cookie) — set by Cloudflare, the content delivery network in front of ngoradar.org, to tell human visitors from automated traffic. It is set on every request, including your first, before you interact with the site: it protects the service rather than serving any purpose of ours, and it carries no identifier we can read or link to you. HttpOnly and Secure, SameSite=None, scoped to ngoradar.org, and it expires 30 minutes after your last request (observed live on 2026-09-21). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping the site available — and § 25(2) No. 2 TDDDG, as it is strictly necessary to deliver the service you requested. See Cloudflare's cookie information at https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.
• ngoradar-trial-refused (session storage, not a cookie) — the value 1, written only if the membership service declines to start a free trial for your account, so the page stops offering you a trial it cannot give you and shows the paid membership instead. It holds no identifier. Session storage is cleared when you close the tab, and we also clear this entry when you sign out. Legal basis: Art. 6(1)(b) GDPR, and § 25(2) No. 2 TDDDG — writing it is strictly necessary to show you the membership you can actually buy.

Analytics — only if you accept

If you accept analytics in the cookie banner, ngoradar.org loads Google Analytics 4, provided by Google Ireland Limited. If you do not, the script is never loaded and neither cookie below is set. With your consent, a page view is recorded for each page you open; Google Analytics 4 does not log or store IP addresses. Google may process the data in the United States, relying on the EU–US Data Privacy Framework. Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. See https://policies.google.com/privacy.

• _ga (cookie) — tells one browser from another, so that visits can be counted. Expires after up to 2 years.
• _ga_<id> (cookie) — keeps the state of the current visit for this site's Google Analytics property; <id> is that property's measurement id. Expires after up to 2 years.

The sign-in service

Signing in or creating an account takes you to the Action Network Worldwide sign-in service, on its own site. The strictly necessary cookies it needs to carry out the sign-in are set there, not on ngoradar.org.

What we do not do

There is no advertising, no cross-site tracking and no live-chat widget on this site, and nothing is sold or shared with data brokers.

Managing your choice

Use “Cookie settings” in the site footer to change your choice at any time — withdrawing consent is as easy as giving it (Art. 7(3) GDPR). A withdrawal takes effect at once: Google Analytics stops, and the analytics cookies it set on ngoradar.org are deleted. You can also block or delete cookies in your browser settings; if you block the strictly necessary ones, signing in will not work. Declining analytics does not stop you reading the site or browsing opportunities.

Contact

Questions about cookies on this site? Email support@ngoradar.org.