> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.noticeable.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Noticeable Widget Cookies

**The Noticeable Widget and Newspage store a small amount of data in the visitor's browser. This data is necessary for technical and service purposes: remembering which publications a visitor has already seen or read, remembering the reaction and feedback a visitor gave on a publication, attributing reactions and feedback to one anonymous visitor, and protecting forms against cross-site request forgery. Noticeable does not use any of it for advertising, analytics profiling or tracking visitors across websites.**

This article lists every cookie and browser storage entry, with its purpose, storage type, retention period and the conditions under which it is created, so you can describe them accurately in your own cookie notice.

# Widget Version 2 (current)

## Data stored on your website

When the Noticeable SDK is loaded on your pages, it stores the following entries under your own domain (first-party). All of them start with the prefix `noticeable_` and end with the identifier of the Noticeable project that is rendered.

| Name | Type | Retention | Created when | Purpose and example |
| ---- |
| `noticeable_lpr_{PROJECT_ID}` | Local storage | Until cleared by the visitor | A publication is opened or marked as read | Remembers which publications were already read. A visitor opens a publication in full: it is shown as read the next time the widget opens, on any page of your website. |
| `noticeable_lps_{PROJECT_ID}` | Local storage | Until cleared by the visitor | A publication is displayed in a widget | Remembers which publications were already seen, to compute the unread badge. The badge shows "3", the visitor opens the widget and sees the three publications: the badge goes back to "0" and stays there on the next pages. |
| `noticeable_traits_{PROJECT_ID}` | Session storage | Until the tab or browser is closed | `identify()` is called with user traits | Attaches the user's name and email to the reactions and feedback they send. You call `identify()` with Jane's email once she is signed in: her feedback shows up in your dashboard as coming from Jane, so you can reply to her. |
| `noticeable_uid_{PROJECT_ID}` | Cookie (Secure, SameSite=None) | 365 days, renewed on each visit | A widget is rendered | Anonymous visitor identifier attached to reactions and feedback. Feedback from the same visitor is grouped under one id in your dashboard, and a visitor who changes a 👍 into a 👎 is counted once. See below. |
| `noticeable_usso_{PROJECT_ID}` | Cookie (Secure, SameSite=None) | 365 days, renewed on each visit | `identify()` is called with an SSO token | Keeps the visitor authenticated with Noticeable across pages. Your backend signs a token once, and the widget and Newspage present it on every page the visitor opens. Removed when `identify()` is called with user traits instead. |

If your integration only calls `noticeable.render(...)`, the `lpr`, `lps` and `uid` entries are created. `traits` and `usso` only appear if you also call `noticeable.identify(...)`.

**About `noticeable_uid_{PROJECT_ID}`**: this is a random identifier (UUID) generated in the browser. It contains no personal data and is never shared with a third party. Noticeable refuses reactions and feedback that do not carry an identifier, which is why the cookie exists even if you never call `identify()`. When [cross-device synchronization](/en-us/article/widget-cross-device-synchronization-1m7jpkm/) is enabled on your project, the seen and read lists are also saved on Noticeable's side under this identifier, so a user identified with the same id on a laptop and a phone gets the same state on both. The cookie expires 365 days after the last visit: its expiration is extended every time a widget is rendered.

## Data stored by widget views and by the Newspage

Modal, popup and top-banner widgets display their content inside an iframe served by Noticeable. The Newspage is served from your newspage domain, either `{subdomain}.noticeable.news` or your own custom domain, both when a visitor opens it directly and when it is embedded on your website through the newspage embed, which is also an iframe.

Entries created inside these iframes are stored under the iframe's domain, not under your website domain. From your website's point of view they are therefore third-party, and modern browsers partition them per embedding site.

| Name | Where | Type | Retention | Created when | Purpose and example |
| ---- |
| `__noticeable-nrm` | Newspage | Cookie (HttpOnly, Secure, SameSite=Strict) | 7 days | A visitor signs in to a password-protected Newspage and ticks "Remember me" | Avoids asking for the shared password again for 7 days. Without the option, the sign-in lasts 30 minutes and no cookie is stored. |
| `noticeable:publications:{PUBLICATION_ID}:comment` | Widget iframe and Newspage | Session storage | Until the tab or browser is closed | A visitor starts typing feedback on a publication | Keeps the feedback draft. A visitor starts writing, clicks a link and comes back: the text is still in the form. Deleted once the feedback is sent. |
| `noticeable:publications:{PUBLICATION_ID}:reaction` | Widget iframe and Newspage | Local storage | Until cleared by the visitor | A visitor reacts to a publication | Displays the reaction the visitor chose on later visits. A visitor reacts with 👎, comes back a week later: the 👎 is still highlighted and can be changed. |
| `noticeable_traits_{PROJECT_ID}` | Newspage | Session storage | Until the tab or browser is closed | `identify()` is called with user traits on your website | Same as on your website. The SDK forwards the traits to the embedded Newspage, so feedback sent from the embed is attributed to the same user. |
| `noticeable_uid_{PROJECT_ID}` | Newspage | Cookie (Secure, SameSite=None, Path=/) | 365 days, renewed on each visit | The Newspage is loaded | Same as on your website. The embedded Newspage receives the identifier created by the SDK on your page, so a visitor has a single id on both sides. Opened directly, the Newspage generates its own. |
| `noticeable_usso_{PROJECT_ID}` | Newspage | Cookie (Secure, SameSite=None, Path=/) | 365 days, renewed on each visit | `identify()` is called with an SSO token on your website | Same as on your website, forwarded by the SDK when the Newspage is embedded. |
| `XSRF-TOKEN` | Newspage | Cookie (HttpOnly) | Until the browser is closed | The Newspage is loaded | Verifies that reactions, feedback and sign-in forms were submitted from the Newspage itself, so another website cannot submit them on behalf of your visitors. Contains no visitor data. Strictly necessary. |

## Adjusting retention and storage type

Local storage entries remain until the visitor deletes them or the browser reclaims space. Compared to cookies, they are not sent with every request, which is why they are the default for `noticeable_lpr_{PROJECT_ID}` and `noticeable_lps_{PROJECT_ID}`.

If your policy requires an expiration time on everything stored on your pages, you can ask the [Noticeable SDK](/en-us/article/how-to-use-the-noticeable-javascript-sdk-7k5kc2/#3-set-global-preferences) to use cookies instead of local storage. The two entries then become cookies (SameSite=Lax) with the retention period configured below.

```
noticeable.set('preferences', {
    firstPartyCookies: {
        localStorage: false
    }
});
```

You can also shorten the retention period of the cookies created by the SDK. The value is expressed in milliseconds and defaults to 365 days. The example below sets it to 90 days:

```
noticeable.set('preferences', {
    firstPartyCookies: {
        retentionPeriod: 7776000000
    }
});
```

Both preferences must be set before the first `noticeable.render(...)` call. They apply to the entries created by the SDK on your website. The entries created inside widget iframes and by the Newspage keep their default retention.

## Clearing stored data

Calling `noticeable.reset()` deletes the identifier, the user traits and the seen/read lists stored on your website, then generates a new random identifier. Call it in your sign-out handler, or when a user asks you to forget them: the next person using the same browser starts with an empty state. See the [Noticeable SDK](/en-us/article/how-to-use-the-noticeable-javascript-sdk-7k5kc2/) article for details.

# Widget Version 1 (deprecated as of 2021/02/01)

When the Noticeable Widget is embedded on your pages, the following cookies are created:

* **noticeable:project:{PROJECT\_ID}:widget:posts:seen**: This cookie appears in the browser local storage to store what posts a user has seen. It is used to know whether new posts should be highlighted between page reloads. This cookie remains until the user clears its browsing history or manually deletes the local storage entry.

* **noticeable:project:{PROJECT\_ID}:widget:posts:read**: This cookie appears in the browser local storage to store what posts a user has read. It is used to know whether a post must be marked as read in the widget or not. This cookie remains until the user clears its browsing history or manually deletes the local storage entry.

* **\_\_cfduid**: This browser cookie is a third-party cookie set by Cloudflare when Noticeable Widget resources are loaded. We make use of Cloudflare as a CDN to improve static resource loading. The cookie expires after 30 days. You can learn more about this cookie on the next page: https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682

Additionally, the following cookies may be set depending of the Noticeable features used:

* **noticeable:project:{PROJECT\_ID}:widget:posts:reaction:{POST\_ID}**: This cookie appears in the browser local storage to store what reaction a user has selected when the emoji reaction feature is enabled on a post. The cookie is used to restore the user choice when a user come back on a post where he has already reacted. This cookie remains until the user clears its browsing history or manually deletes the local storage entry.

* **noticeable:project:{PROJECT\_ID}:widget:posts:feedback:{POST\_ID}**: This cookie appears in the browser local storage to store when the last feedback was made for a given post when the user feedback feature is enabled . This cookie is used to hide the feedback form when a feedback was already sent recently, thus preventing spam. This cookie remains until the user clears its browsing history or manually deletes the local storage entry.

* **noticeable:session**: This browser session cookie stores user data for the duration of the session when the cross-device synchronization feature is configured: https://help.noticeable.io/en-us/article/widget-cross-device-synchronization-1m7jpkm/. This session cookie is used to pass identity information when a user submits feedback on a post, thus allowing you to know who submitted what feedback and have a means to contact the user back if needed. This session cookie gets cleared when the browser / browser tab is closed.