Cookies policy

Cookies are information a site stores in a browser and may receive again. Local storage can persist until cleared; session storage ordinarily belongs to an open browsing session, although an application's expiry rules may be shorter. Device-access rules also cover similar technologies and certain signals, not only cookies.

First-party technologies belong to the site you visit; embedded providers may store or access information too. Data processing involving personal information is also subject to the Privacy Policy.

Carya uses device storage only where it is needed for a feature you use: signing in, keeping your Account secure, connecting a payment account, opening a password-protected Page, keeping a draft, and remembering choices you make in the interface. Carya treats these as strictly necessary for the service you request, or as interface settings you choose.

Carya uses no advertising storage and no measurement storage. Its visit counting stores nothing on and reads nothing from your device (section 5). For that reason Carya does not show a cookie banner.

If Carya adds an optional use of device storage, it will ask first wherever the law requires prior consent, with refusing and withdrawing as easy as accepting, and keep the optional use off until you choose. Some jurisdictions apply narrower or different exemptions; Carya applies the rule for the region concerned.

These cookies are set on carya.page when you sign in:

• "__Secure-better-auth.session_token": keeps you signed in. It lasts seven days and is renewed while you keep using Carya.
• "__Secure-better-auth.convex_jwt": a short sign-in token used to load your work. It lasts fifteen minutes and is renewed while you are signed in.
• "__Secure-better-auth.state": a short-lived security cookie used while you sign in with Google or Apple.

"__Host-carya_pay_connect": a security cookie that lasts fifteen minutes while you connect a HitPay account to a Page.

These cookies are set only for carya.page, are marked Secure and HttpOnly, and are never sent to Creator Pages on carya.page subdomains or to Custom Domains. Google and Apple use their own technologies on their own sites during sign-in, under their notices.

In the Editor, local storage may hold the last Page you opened, a hint that you are signed in (used to show the right screen sooner), your light or dark theme, onboarding choices you made, whether you have already seen a Page's "now live" moment, and a guest draft and pending guest publish. A pending guest publish expires after thirty minutes. Two further items switch on features being tested, only when someone opens a testing address. Other items remain until you clear them or sign out.

Session storage in the Editor may hold where to return after sign-in, a guest draft being carried into a new Account and your progress through onboarding, for the open tab.

On Carya's website, local storage may keep a drawing you made on the home page and whether you dismissed the offer to switch language; session storage remembers, for the open tab, whether you have seen the home page's drawing hint.

A guest draft stays on your device until you choose to create an Account and transfer it. None of these items is used for measurement or advertising, and none is sent to Carya except a draft you choose to save or transfer.

Carya counts visits to published Pages and to carya.page without storing or reading an identifier on your device. The Privacy Policy describes the transient, daily-changing counting value and the statistics Carya keeps.

Network and security providers may still see an IP address or other signals when carrying traffic. That is described in the Privacy Policy, not achieved through device storage.

When a Visitor enters a Page's password, Carya sets a cookie named "__Host-carya_unlock". It is limited to that Page's address, marked Secure and HttpOnly, and lasts up to seven days. Changing the Page's password ends existing unlocks.

The unlock cookie is used only to give access to the Page whose password was entered, not for measurement or any other purpose.

The age notice before a Mature Page stores nothing on your device: continuing adds a marker to the Page's address instead.

Carya uses Cloudflare Turnstile to help distinguish people from bots on sign-up, sign-in, password reset, the report form, Page forms, Buy buttons and password-protected Pages. On published Pages it loads only when a Visitor reaches one of these. It processes browser and connection signals including IP address, browser information and site context. Cloudflare's Turnstile Privacy Addendum describes its processor role for site security and its separate controller role for improving bot detection: https://www.cloudflare.com/turnstile-privacy-policy/ .

Turnstile runs in a frame from Cloudflare's challenge domain. Carya does not enable Turnstile's pre-clearance option, so no "cf_clearance" cookie is set for Carya.

Videos, music, maps, calendars, booking widgets and other embeds can contact their provider and set or read storage as soon as they load. On published Pages, Carya shows a placeholder instead and loads the embedded service only when the Visitor clicks to load it. After that, the provider's own policy applies. Creators choose which providers to embed and remain responsible for their own notices.

Google and Apple sign-in and the Payment Provider's checkout page use technologies on their own sites, governed by their notices. Carya identifies the provider at the relevant interaction. Carya does not certify the cookie behaviour of every embedded provider a Creator chooses.

You may manage browser cookies and storage through browser settings. Blocking sign-in or access storage may prevent requested features; clearing it may sign you out or erase an unsaved guest draft. Account-saved content is not deleted merely by clearing the browser.

If Carya offers optional processing in future, refusing, withdrawing or objecting will be as easy as the initial choice, without unnecessarily blocking core features. A browser setting does not replace a choice the law requires Carya to ask for. Contact hello@carya.page with questions about any storage.

Carya maintains an inventory of the storage used on its website, workspace and hosted Pages, including locked Pages, sign-in, embeds and Turnstile, recording names, provider, purpose, domain, duration and treatment, and updates this policy when that changes.

Non-material policy updates may take effect at any time on publication. Material changes follow the Terms' seven-day direct advance-notice process where applicable, subject to mandatory legal requirements. A new optional purpose requires a new choice where legally required, not presumed consent from continued use.

Questions and rights requests: hello@carya.page. Operator: PT Solusi Akal Imitasi, Yogyakarta, Indonesia. This policy takes effect on publication. A legally reviewed Bahasa Indonesia translation will be published alongside English.