Legal
Cookies
This page describes cookies and related browser data NATION RANK currently uses. It is not a substitute for counsel-reviewed terms.
First-party cookies
nr_referral. Set only after a valid invite URL. HttpOnly, SameSite=Lax, path=/, and Secure on HTTPS. Maximum age is 30 days. It stores the invite code so a later qualifying signup can attribute Bonus Points. It is not an advertising cookie. It is not required for rankings or guest checkout.
Supabase auth/session cookies. Used for signed-in sessions. Names typically follow sb-<project-ref>-auth-token and may be split into chunked variants. A PKCE / code-verifier cookie may appear around authentication (for example email confirmation). These are required for signed-in account features. They are not required for guest rankings or guest support. Duration follows Supabase session behavior; it is not hard-coded in this app.
Browser storage
This app does not use first-party localStorage or first-party sessionStorage.
Third-party and external services
Cloudflare Turnstile may load on sign-in, sign-up, and forgot-password when it is configured (production). It is not loaded on other public pages.
Stripe-hosted Checkout runs on Stripe's domain after you choose to continue to payment. Stripe may set cookies there. This app does not load Stripe.js on NATION RANK pages.
Public avatars may load from Supabase Storage in the browser. The site is hosted on Vercel, which may keep request logs and optimize images. Country flags are loaded through Next.js image optimization; the optimizer may fetch flagcdn.com. Resend sends transactional email (such as account confirmation). It is not a browser tracker.
Analytics and advertising
The current app does not include Google Analytics, a Meta Pixel, the Vercel Analytics package, or advertising cookies.