Cookie policy

1. What cookies are and why we mention them

Cookies are small files placed by a website in your browser, used to remember preferences, maintain authentication sessions or measure traffic. GDPR + ePrivacy Directive require consent for any non-essential cookie (marketing, analytics, tracking).

CAP APP is built not to require any non-essential cookies. The policy below describes exactly what is stored and why.

2. On the marketing site

We use no tracking cookies, no Google Analytics, and no third-party resources (no Google Fonts, no embeds). We store locally in localStorage only your theme preference (light / dark) and language preference — this is not transmitted to us and is not shared with third parties.

3. In the CAP APP application — storage in use

The app uses two items in sessionStorage (not cookies, so nothing is sent with each HTTP request; cleared automatically when the tab closes):

cap_token — session JWT for the authenticated user, used to sign API requests. Duration: browser session (cleared on logout or when the tab closes). Not used for cross-site tracking.

cap_user — local user metadata (name, email, role) for UI display without an extra request. Duration: browser session. Not transmitted to third parties.

We do not set or read any third-party marketing, analytics or tracking cookies. We do not integrate Facebook, Google or LinkedIn pixels.

4. Third-party cookies (contextual)

When you pay via Stripe (billing page), Stripe.js loads resources from the stripe.com domain and may set its own cookies there for fraud detection (Radar). These cookies remain under Stripe's policy and cannot access CAP APP data. See Stripe policy at stripe.com/privacy.

Cloudflare, as the site CDN, may set the technical cookie __cf_bm for bot detection and rate limiting — required for DDoS protection to work. Not used for tracking.

5. How to control them

On your first visit a banner shows three options: "Accept all", "Only necessary" and "Settings" (per-category control). The choice is saved in localStorage under the key cookie_consent, versioned (v1) — if we change the categories later we will ask you again.

You can change your preferences anytime by clicking the "Settings" button in the footer. From the same modal you can click "Withdraw consent" to clear the saved choice — the banner then reappears immediately.

You can clear sessionStorage and localStorage from browser DevTools (Application → Storage → capapp.ro → Clear). Effect: logs you out and resets preferences; server-side data is untouched.

You can block Stripe cookies by selectively blocking the stripe.com domain in your browser — but payments will stop working.

Cloudflare technical cookies can be controlled from browser settings; blocking them may reduce anti-bot protection.

6. Policy changes

When CAP APP adds functionality that requires new cookies (e.g. cross-tab authentication via httpOnly cookie), we will update this page and request explicit consent where legally required. Notice at least 30 days in advance.