Cookie and storage policy

Scope and consent

The website code adds no audience measurement, advertising or optional storage. No consent banner is currently added. This conclusion concerns the application integration; it does not certify remote Cloudflare, Turnstile, Stripe or Resend settings.

Exemption requires strict necessity for communication or the expressly requested service and a proportionate lifetime. Security or payment provides no blanket exemption. The same rules cover local storage and terminal access. Any optional addition must be blocked before valid consent, with acceptance, refusal, customisation and equally easy withdrawal.

Website inventory

purchase_<order identifier without hyphens>: first-party cookie supplied by the site to authenticate order and download access, without profiling. Domain: current host, with no Domain attribute; path /api/orders/; HttpOnly, Secure, SameSite=Lax. Set only when successfully opening Checkout. Initial lifetime: remaining Stripe session time + 7 days, capped at 8 days; viewing a paid order shortens it to remaining access, no later than 7 days after payment. Cleared when an expired or revoked access is visited. Functional necessity is assessed for the requested service and must be reconsidered if use or lifetime changes.

Basket: form checkboxes and page memory, without a dedicated cookie or programmed persistence. Contact/OpenPGP: fields and encryption in memory, without intentionally copying the message to localStorage or sessionStorage. Downloads: URL-fragment token immediately removed from the address and placed in the form, without added persistent storage; maximum validity 48 hours within 7 days of access. D1 orders and hashed tokens are server storage, not browser cookies.

The site adds no explicit localStorage, sessionStorage or IndexedDB use. No site advertising or analytics tool was identified. These findings do not inventory providers’ internal code.

The site uses Google Search Console for search visibility, not Google Analytics. Search Console and ownership verification add no audience-measurement cookie or script here. No Google Analytics, GTM, advertising pixel or optional tracking tool was identified in the reviewed code. Possible Cloudflare-level injections require separate verification.

Cloudflare, Turnstile and Stripe

Cloudflare Pages and its protections may add mechanisms depending on account settings. Turnstile loads only when interacting with the form to protect the requested submission; its token is verified server-side. Documentation distinguishes standard mode from pre-clearance, which may issue cf_clearance. [TO CONFIRM: no pre-clearance, actual mechanism names and lifetimes, strict necessity and no optional reuse]. Cloudflare cookies are not declared absent solely from local code.

Stripe Checkout opens on checkout.stripe.com after your order action; no Stripe.js is embedded on site pages. Stripe documents __stripe_mid (1 year) and __stripe_sid (30 minutes) on its Checkout for fraud prevention. These are provider-documented lifetimes, not observed deposits in your session. Stripe becomes the visited domain; these cookies are not created by Aïda Hamzi’s code. Necessity and other Checkout choices must be assessed against the enabled features, without automatic exemption.

Resend operates server-side for emails without adding a website script. Remote open/click tracking settings must be confirmed disabled; our templates add no tracking pixel. Names, domains, paths, lifetimes and purposes of any remote mechanisms still require verification before final publication.

Management and information

You can erase site data through your browser; deleting the purchase cookie may prevent browser order access without deleting the contract or your rights. Personal email links remain usable within their lifetime and quota. No optional-consent preference needs storing while no optional tracker is offered. See the privacy policy for personal data, rights and transfers.