Creavax uses essential cookies and browser storage for secure sessions, language and consent preferences. Optional analytics and marketing storage must remain off until the required permission is recorded.
Service operator
Section 01
| Name | Type | Purpose | Typical duration |
|---|---|---|---|
| Creavax or Laravel session cookie | Essential, HttpOnly | Keeps the authenticated session and security state. | Configured session lifetime; normally about 2 hours unless renewed. |
| XSRF-TOKEN | Essential | Allows the browser to send CSRF protection for authenticated state-changing requests. | Session or framework-configured lifetime. |
| creavax_locale | Essential preference | Stores the language explicitly selected by the visitor and keeps that choice across Creavax. | 1 year. |
| creavax_locale_suggestion_seen | Essential preference | Prevents the optional regional language suggestion from appearing repeatedly after it is accepted or dismissed. | 6 months. |
| creavax_admin_locale | Essential preference | Stores English or Persian for the admin panel only. | 1 year; scoped to /admin. |
| creavax-cookie-consent-v1 | Essential preference | Stores the analytics and marketing consent choice. | 1 year. |
Section 02
Creavax may use local storage for interface preferences, temporary editor state, install-prompt choices and consent fallback. The installed PWA may cache public static files and the offline page. Authenticated pages, API responses, private assets and generated user media must not be stored in the public Service Worker cache.
Section 03
Essential storage supports authentication, CSRF protection, secure sessions, load balancing, language, consent, editor recovery and other functions requested by the user. Blocking it may sign you out, reset preferences or prevent the service from working.
Section 04
Optional analytics is disabled by default until consent is recorded where consent is required. When enabled, analytics should be limited to reliability and product events and should not include prompt bodies, uploaded files, generated content or payment secrets unless a separate purpose and lawful basis are documented.
Section 05
Marketing measurement is disabled by default in this release. It must not be activated until the provider, purpose, data fields, retention period, transfer safeguards and withdrawal controls are documented in this policy and the consent interface.
Section 06
Use the preference control on this page to accept, refuse or later withdraw optional categories. Refusing optional storage must be as easy as accepting it. Withdrawal does not affect processing that was lawful before withdrawal.
Browser settings can also block or delete storage, but doing so may sign you out or remove saved preferences.
Section 07
A third-party video, support, analytics, advertising or social embed can create its own cookies or browser storage. Non-essential embeds must remain blocked until the required consent is available, and this inventory must identify the provider and purpose before production use.
Section 08
The inventory must be updated before any new non-essential cookie, analytics SDK, advertising tag or embedded third-party service is enabled. Material changes will be shown with an updated effective date and renewed consent where required.
