Nuuly.com

cache-control: private
location: https://www.nuuly.com/
content-length: 0
date: Mon, 20 Oct 2025 09:16:48 GMT
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-datadome: protected
accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
set-cookie: datadome=0m9MT7VTlBI8HoP~y3hjfUBMHeCUBnpJKKIwBTqYUXFeV2EAaiPROpeWmdpBGSKBCdqZGd4YGsrGBCUZ_dmesYjPC_I5h4fcAGtjV58VtnzKAY_LQPDiY~kbS4ggJtcR; Max-Age=31536000; Domain=.nuuly.com; Path=/; Secure; SameSite=Lax
via: 1.1 google

HTTP/2 200 
x-powered-by: Express
content-type: text/html; charset=utf-8
set-cookie: x_nuuly_clientId=703b5756-ea10-41af-8c85-8d1a31724443; Max-Age=157784630; Path=/; Expires=Sun, 20 Oct 2030 14:20:39 GMT
set-cookie: datadome=~bYOzZNRa910MQcFMabU87E34ghG_z8BArrW48qeVgEnsXRNZM59Otre2xnvgppVIhvwLm3RW3WmYMnat6FpI~9Hi4t_nmEZn7rRLkRVtJXvjc3wI4CnYYbkzC1PiFGD; Max-Age=31536000; Domain=.nuuly.com; Path=/; Secure; SameSite=Lax
content-security-policy: default-src 'self' 'unsafe-eval' 'unsafe-inline' data: https://tag.tapad.com https://*.appboycdn.com https://*.intercomcdn.com https://*.crazyegg.com https://*.dashhudson.com https://*.split.io https://*.stripe.com http://*.friendbuy.com http://djnf6e5yyirys.cloudfront.net http://idsync.rlcdn.com http://images.ctfassets.net http://tag.rmp.rakuten.com https://*.crazyegg.com https://*.friendbuy.com https://*.intercom.io https://*.linksynergy.com https://*.scene7.com https://api.recurly.com https://cdn.contentful.com https://connect.facebook.net https://www.pinterest.com https://ct.pinterest.com https://djnf6e5yyirys.cloudfront.net https://idsync.rlcdn.com https://images.contentful.com https://images.ctfassets.net https://js.appboycdn.com https://js.recurly.com https://nypi.dc-storm.com https://s.pinimg.com https://sdk.iad-01.braze.com https://static.intercomassets.com https://stats.g.doubleclick.net https://storage.googleapis.com https://tag.rmp.rakuten.com https://us-east4-rental-dev.cloudfunctions.net https://us-east4-rental-prod.cloudfunctions.net https://us-east4-rental-staging.cloudfunctions.net https://videos.contentful.com https://videos.ctfassets.net https://www.facebook.com https://*.google-analytics.com https://*.google.com https://www.google.com.pr https://www.google.co.uk https://www.google.ca https://www.google.de https://www.google.fr https://www.google.es https://www.google.com.au https://www.google.co.jp https://www.google.nl https://www.google.it https://www.google.com.mx https://www.google.ie https://www.google.com.ar https://www.google.co.nz https://www.google.co.in https://www.googletagmanager.com ws: wss: *.rewardstyle.com *.nuuly.com *.tiktok.com *.typhoona.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://td.doubleclick.net https://d38xvr37kwwhcm.cloudfront.net https://www.cloudflare.com/cdn-cgi/trace https://trail.grin.co https://fast.fonts.net https://data.adxcel-ec2.com https://trkn.us https://js-agent.newrelic.com https://bam.nr-data.net https://*.clarity.ms https://*.bing.com https://*.pdst.fm https://*.cloudfunctions.net/pdst-events-prod-sink https://*.byspotify.com blob: https://intercom-sheets.com https://*.fbot.me http://*.tvsquared.com https://adsmeasurement.com amazon-adsystem.com *.amazon-adsystem.com paa-reporting-advertising.amazon *.paa-reporting-advertising.amazon https://pixels.spotify.com https://*.prod.uidapi.com https://prod.uidapi.com https://*.adsrvr.org https://www.redditstatic.com https://*.reddit.com https://sc-static.net/scevent.min.js https://*.snapchat.com https://*.snapchat.com/pm http://bat.bing.com/bat.js; frame-ancestors 'none'; report-uri https://www.nuuly.com/api/security/csp/violation
etag: W/"b4518-SQa1CuIpuFuKBT3cXRDtMLi6p/k"
vary: Accept-Encoding
content-encoding: gzip
date: Mon, 20 Oct 2025 09:16:49 GMT
via: 1.1 google, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: x-nuuly-clientid,x-urbn-channel,x-urbn-auth-code-bypass,content-type,x-urbn-clientId,x-urbn-responseId,x-urbn-trackingOptIn,x-urbn-query-version
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-datadome: protected
accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory