Cookie policy

Pages without a form set no cookies of ours, and we use no advertising cookies until ads go live. Once we switch Google Analytics on, it sets two first-party analytics cookies, _ga and _ga_<ID>, as described below. The forms use a security cookie, cp_xsrf, and Cloudflare, which delivers and protects the site, may set strictly necessary cookies of its own. This page explains what cookies and browser storage are, which kinds the site uses and how you can control them. Read the privacy policy for how we handle personal data.

What cookies and browser storage are

A cookie is a small text file that a website asks your browser to keep. The browser sends it back to the site on later requests. Browser storage is similar. It is a place in your browser where a page's script can save a short value. The difference is that browser storage is not sent to the server with every request.

We use both and say which is which. The table at the end of this page lists everything the site itself sets.

The kinds we use

Strictly necessary

These make the site work or keep it safe. We do not ask for consent for them.

A security cookie, cp_xsrf, that protects forms against forged requests. A visitor receives it only when opening a page with a form, such as the contact form.
Sign-in cookies for our own staff. Visitors never receive them. They hold a staff member's session and, for a few minutes, a half-finished sign-in. A further cookie remembers the language of the administration area, and the browser storage entry cp-admin-theme keeps its light or dark theme.
Cookies of Cloudflare, which keep the site delivered and protected, such as __cf_bm (bot protection), __cfruid (rate limiting) and cf_clearance (set after a security check).

Preferences

When you pick a country, or press the theme button, the site saves your choice in your browser's storage so that prices, units and colors stay as you set them. If you have not chosen a country, the page asks our server once for a suggestion, based on the country code Cloudflare derives from your IP address, or else your browser language, or else the United States. We do not store or log the answer. The page keeps it as cp_visitor in session storage until you close the tab, so that it asks only once.

These values are not cookies, and our servers never read them. Your country and theme choices give you what you asked for, such as prices in your own country, so we do not ask for consent for them.

The site does not show ads or set advertising cookies yet. We plan to apply to Google AdSense after the site has been public for a while, and ads will appear only after approval. When ads are live:

In the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell where you are, no ad request is made and no advertising cookie is set until the CMP has asked for your consent. If the CMP does not load, we show no ads.
In other places, ads may load without a consent banner. You can still block or delete cookies in your browser.
The consent tool will be a Google-certified consent management platform (CMP). We will choose it and name it here before any ad is shown.

Once we switch it on, Google Analytics counts page views. It sets two first-party cookies on this site: _ga tells visitors apart, and _ga_<ID> keeps the state of a visit. Google's default life for both is 2 years, and browsers may shorten it.

In the European Economic Area, the United Kingdom, Switzerland and wherever we cannot tell where you are, Google Analytics loads and sets these cookies only after you agree in the consent tool. If you do not agree, or the tool does not answer within 8 seconds, it does not run.
Elsewhere it runs without a banner unless your browser sends the Global Privacy Control signal.
Google signals and ad personalisation are off. Google acts as our processor; see the privacy policy.

Cookies from ad partners

When ads are live, Google and other ad partners can set or read their own cookies and similar identifiers in your browser. They use them to choose, limit and measure ads. We do not control these cookies, and they change often, so we cannot list them here. Each partner explains its use in its own privacy policy. Where consent is required, they are used only after you agree in the consent tool.

The table at the end of this page covers what our own site stores. It does not list cookies set by ad or consent partners.

When the consent tool is live, a button labeled "Cookie and ad choices" appears in the footer wherever we ask for consent, for ads or for analytics. It reopens the consent tool, where you can accept, reject or adjust your choices. A new choice applies from the next page you open. You can withdraw consent at any time. Withdrawing stops Google Analytics from the next page you open, and the site then removes the _ga and _ga_<ID> cookies from your browser.

How to clear browser storage

You control what your browser keeps.

Open your browser's settings and find the section on cookies and site data, or on privacy.
Search for this site, or view all stored site data.
Delete the data for CarPairly.

This removes cookies and browser storage together. The site then forgets your country and theme and falls back to its defaults until you choose again. The public pages keep working if you block cookies.

Changes and contact

We update this page when the site changes what it stores. For questions, write to admin@carpairly.tech or use the contact form.

The complete list

The table that follows this text is generated by the code that runs the site. It is not typed by hand, so it matches what the site really sets. For each entry it shows the name, whether it is a cookie or browser storage, what it is for, how long it lasts and when it is set.

Name	Kind	Purpose	Lifetime	Set when
cp_auth	Cookie	Keeps an administrator signed in. Visitors never receive it.	Until the browser closes, at most 12 hours	When an administrator signs in
cp_2fa	Cookie	Holds the half-finished sign-in of an administrator between the password and the second factor.	5 minutes	After an administrator enters a correct password
cp_xsrf	Cookie	Protects forms against cross-site request forgery.	Until the browser closes	When a page with a form is opened
cp_culture	Cookie	Remembers the language of the administration interface. Visitors never receive it.	1 year	When an administrator picks a language
cp_market	Browser storage	Remembers the country you picked, so prices and units follow it.	Until you clear site data	When you pick a country
cp_theme	Browser storage	Remembers a light or dark theme you picked.	Until you clear site data	When you press the theme button
cp_currency	Browser storage	Remembers the currency you picked for the approximate second price line, or that you switched it off.	Until you clear site data	When you pick a currency in the header
cp_visitor	Browser storage	Keeps the country suggested for this visit, so it is looked up once.	Until the tab closes	On a page with prices, when no country or currency is chosen