Cookie Notice

1. Purpose

This Cookie Notice explains how SyncReserve currently uses cookies, local storage, and similar browser technologies for core service operation, security, and consent management.

This notice is intentionally based on the current repo behavior. It should be updated when new optional analytics, advertising, or tracking technologies are actually introduced.

---

2. Categories We Currently Use

Essential cookies

These cookies are used to operate the platform and cannot be disabled without breaking core functionality.

Current examples in the repo include:

• admin_auth_token
  • used to maintain authenticated admin sessions
• guest_auth_token
  • used to maintain authenticated guest sessions
• auth_token
  • legacy authentication cookie still supported for migration compatibility
• checkout_token
  • temporary cookie used to preserve access to certain guest checkout flows
• csrf_token
  • used for CSRF protection on relevant unsafe requests
• sr_turnstile_pass
  • short-lived anti-abuse bypass cookie used after successful Turnstile or Cloudflare preclearance validation
• cf_clearance
  • Cloudflare-managed anti-bot/preclearance cookie when applicable

These cookies are used for authentication, checkout continuity, abuse prevention, and request integrity.

Preference storage

SyncReserve currently stores consent state and cookie preference selections in local storage through:

• syncreserve_cookie_consent
• syncreserve_cookie_preferences

These values support the cookie-consent banner and preference UI.

Optional analytics and marketing categories

The current consent UI includes preference categories for:

• analytics
• marketing

At the repo level, these preference categories exist in the consent interface and local storage model. This notice should be updated as optional analytics or marketing cookies are actually deployed or materially changed.

---

3. How We Use These Technologies

SyncReserve currently uses cookies and local storage to:

• keep users signed in
• protect sessions and sensitive flows
• support checkout and transaction continuity
• help prevent bots, abuse, and fraud
• store cookie-consent preferences

---

4. Representative Technical Behavior

Current repo-backed examples include:

• auth cookies are set as httpOnly and use SameSite=Strict
• checkout flow cookies are short-lived and flow-specific
• the CSRF token cookie is readable by the browser so clients can mirror it in request headers
• the Turnstile bypass cookie is short-lived and used to reduce repeat challenge friction after successful verification

Some cookie settings vary by environment, such as the Secure flag being applied in production.

---

5. Managing Preferences

Users can:

• use the SyncReserve cookie-consent banner and preferences UI where available
• choose essential-only preferences
• adjust browser cookie settings
• clear stored browser data, including cookies and local storage

Disabling essential cookies may prevent parts of SyncReserve from working correctly.

---

6. Changes to This Notice

SyncReserve may update this Cookie Notice when cookie behavior, consent tooling, or third-party services change. The business-brain copy should be updated whenever the public policy surface or implementation materially changes.

---

7. Contact

For questions about this Cookie Notice, contact support@syncreserve.com.