Cookie Policy
Version 2, last updated Sep 16, 2026
This policy explains which cookies and similar technologies Nmjoy ("we", "us") uses when you use the Nmjoy marketplace, why, and how you control them. It forms part of our Privacy Policy.
1. Cookies we set ourselves
A cookie is a small text file stored in your browser. We set the following cookies. None of them is used for advertising, and none follows you to other websites.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| Session cookie | Us | Identifies your signed-in session so that you stay signed in as you move between pages | Kept for up to 400 days, but your session ends when you sign out or after about a month without using the site |
| Google sign-in cookie ("__Secure-google_oauth") | Us | Protects a sign-in with Google against forgery while you are away at Google, then is deleted | 10 minutes |
| Sign-in step cookie | Us | Holds a sign-in, sign-up or new password between its steps, while we wait for your two-step code or for the code we emailed you. It is signed or encrypted so it cannot be altered, and is deleted once the step is done | 10 minutes for a two-step code, 15 for an emailed code |
| Device cookie | Us | A random identifier for this browser, set the first time you try to sign in, sign up or reset a password, so that we can limit repeated attempts per browser rather than per network. We keep only a one-way hash of it, with when it was first and last used, and delete it after a year unused. It is not linked to your account | 1 year |
| "nm_consent" | Us | Records whether you accepted or declined advertising cookies on this site, so we do not ask again on every page. It is set whichever you choose. | 1 year |
| "cart" | Us | Holds what you add to your cart before signing in, so it is still there when you come back. Moved into your account's cart, and deleted, once you are signed in | 1 year |
| "sidebar_state" | Us | Remembers whether you collapsed the side menu in the seller or admin workspace. Set only when you change it. | 7 days |
Signing in requires the sign-in cookies; blocking them means you cannot sign in or stay signed in. Browsing product pages without an account still works, and blocking the "cart" cookie only means a cart you fill before signing in is not kept.
We also keep a few preferences in your browser's local storage rather than in cookies: your light or dark theme and your three most recent searches. This data stays in your browser and is never sent to us.
Local storage also holds the last 12 products you looked at, so the homepage can show them under "Recently viewed". To show them, the homepage sends us those products' identifiers and we send back their details; we do not keep the list or link it to you or your account. Clearing your browser's site data removes it.
2. Advertising cookies
Advertising tags load only if you choose "Accept" in the cookie notice on the site you are on. If you decline, or have not yet chosen, no advertising tag loads there, nothing is sent to Meta or Google from your browser, and the site works exactly the same. Once you accept, two kinds of advertising tag can load: our own Meta Pixel, and tags a seller attached to their own products.
Our own Meta Pixel
We advertise Nmjoy on Meta (Facebook and Instagram). Our advertising partner is Meta Platforms, and we use its Meta Pixel to measure and improve our own advertisements: to see which of them lead to visits and sales, and to decide where to advertise. A sale our advertisements lead to can happen on any of our sites, so the Meta Pixel runs on the Nmjoy marketplace and on sellers' store sites: each store's Nmjoy subdomain and its own domain if it has one. It reports:
| Event | When | What is sent |
|---|---|---|
| Page viewed | You open a page, except a page whose address carries a private link, such as a password reset | That the page was viewed |
| Product viewed | You open a product page | The product's identifier and price |
| Added to cart | You add a product to your cart | The product's identifier |
| Checkout started | You open the checkout page | The product's identifier and price |
| Purchase | Your order is confirmed | The identifiers of the products delivered, the order value, its currency (Indian rupees), and the order identifier, so that the same purchase is not counted twice |
With every event, Meta also collects what your browser sends when it loads Meta's code: your IP address, your browser's user agent (the browser, device and operating system it reports), and the address of the page and of the page you came from. The Meta Pixel sets and reads these cookies on the site you are on:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| "_fbp" | Meta, through the Meta Pixel | Identifies this browser to Meta, so that visits and purchases can be linked to the advertisements that led to them | 90 days, renewed while you keep visiting |
| "_fbc" | Meta, through the Meta Pixel | Set only when you arrive by clicking an advertisement on Meta; records that click | 90 days |
A seller's Meta Pixel on the same page uses the same two cookies. We do not send Meta your name, email address, phone number, account details or payment details, and we do not sell your data.
Sellers' own tags
Sellers may advertise their products on Meta or Google. So that a seller can see which advertisements led to sales, and how their products are performing, a seller can attach their own Meta Pixel or Google Analytics tag to a product. When you have accepted, a seller's tag loads only on that seller's pages, and only for a product the seller attached it to: the product's page, on the marketplace or on the seller's store site, and the order confirmation on the seller's store site after a purchase made from it. It never loads on another seller's pages or on our own pages, such as the home page, search, your account or checkout. It reports:
| Event | When | What is sent |
|---|---|---|
| Product viewed | You open the product page | The product's identifier and price |
| Purchase | Your order is confirmed on the seller's store site | The identifiers of that seller's products you bought, the amount paid for them in rupees, and an order reference so that the same purchase is not counted twice |
Each event goes only to the tag it is meant for: our events to our Meta Pixel, and a seller's events to that seller's tags. We do not send your name, email address, account details or payment details to Meta or Google. Because a tag is loaded from Meta's or Google's servers by your browser, they receive what a browser normally sends, such as your IP address and browser and device information, and they may set or read their own cookies on your device under their own policies. Meta and Google process this data outside India, including in the United States.
Each seller decides which tags to attach and which of their products they cover. A seller's tags, and what the seller does with what they report, are the seller's responsibility.
3. Who is responsible
We show the cookie notice and obtain your consent. For our own Meta Pixel, we are the data fiduciary under the Digital Personal Data Protection Act 2023 for collecting this data on our sites and sending it to Meta. For a seller's tag, we and the seller who attached it are each responsible as data fiduciaries for its collection on our pages and its sending to Meta or Google, and the seller must handle it in accordance with our Seller Data Addendum. Meta and Google are separate data fiduciaries for what they do with the data once they receive it; their own policies govern that use and any opt-outs they offer.
4. How to control cookies
- Advertising tags. Choose "Accept" or "Decline" in the cookie notice. To change your choice or withdraw your consent later, open Cookie settings at the foot of any page: once you have accepted, it offers "Withdraw consent". From then on no advertising tag loads on that site, neither our Meta Pixel nor a seller's tag, and tags already loaded on the open page are told to stop. Withdrawing does not recall data already sent, which Meta's and Google's policies govern.
- Each site asks separately. The marketplace and each store's own addresses (its Nmjoy subdomain and its own domain) are separate sites: each asks for your choice and keeps its own "nm_consent" cookie, and Cookie settings changes the choice for the site you are on only. On a store's site the notice names both us and the seller. You can also delete the cookie in your browser settings; that site's notice then asks again.
- All cookies. You can block or delete cookies through your browser settings; every major browser explains how in its help pages.
5. Changes
We may publish a new version of this policy, for example if the cookies we set or the providers involved change. Every version is numbered and kept, so you can read the exact version that applied at any time. This is version 2. Version 1 described strictly-necessary cookies only and was replaced when we added, with your consent, the advertising tags described in section 2.
6. Contact
Questions about cookies or privacy: privacy@nmjoy.com.
Your cookie choice
Earlier versions
Every version is kept, so you can read the exact text that applied at any time.