TEMPLATE — REVIEW BEFORE PUBLISHING This document is a generic boilerplate that ships with claudephpframework. It is not legal advice. Replace every [BRACKETED] placeholder, edit the cookie inventory in section 4 to reflect what your specific install actually uses, and have a qualified privacy lawyer review the result. Cookie law (ePrivacy in the EU/UK, CCPA/CPRA in California, and others globally) is fact-specific — what cookies you actually drop matters more than what a template says you drop.
Effective date: [EFFECTIVE DATE] Last updated: [DATE OF LAST UPDATE]
This Cookie Policy explains how [YOUR ORGANIZATION NAME] ("we", "us", or "our") uses cookies and similar technologies on the website and services located at [WEBSITE URL] (the "Service"). It supplements our Privacy Policy and forms part of how we satisfy our legal obligations to be transparent about tracking technologies.
1. What are cookies?
Cookies are small text files that a website stores in your browser when you visit. They let the site remember information about your visit (such as that you are signed in, or what theme you've chosen) so it can work properly and provide a better experience the next time you return.
We also use related technologies that behave similarly to cookies — for example, browser local storage, session storage, and (where applicable) small tracking pixels. References to "cookies" in this Policy include those technologies where they perform a similar function.
2. Categories of cookies we use
We group cookies into four categories. The first category is required for the Service to work; the other three are optional, and you control which of them are active.
2.1 Strictly necessary
These cookies are essential for the Service to function. They cannot be disabled because the Service does not work without them. Examples include:
- the session cookie that keeps you signed in;
- the CSRF cookie that protects forms from cross-site request forgery;
- the cookie-consent cookie that records which categories you have
accepted, so we don't ask again on every page.
These cookies do not track you across other sites, do not build an advertising profile, and do not require your consent under most laws because they are necessary to deliver the service you have asked for.
2.2 Preferences
These cookies remember choices you make so the Service feels consistent between visits. Examples include:
- your theme preference (light, dark, or system);
- your chosen language or locale;
- preferences you have set on optional UI elements.
We only set these cookies if you accept the "preferences" category.
2.3 Analytics
These cookies help us understand how the Service is used in aggregate, so we can improve it. They may be set by us or by analytics providers we have engaged. They are configured to anonymise or aggregate data where feasible.
We only set these cookies if you accept the "analytics" category. The analytics provider currently configured for this Service is [ANALYTICS PROVIDER NAME OR "none"].
2.4 Marketing
These cookies, where used, help us measure the effectiveness of marketing or to deliver advertising that may be relevant to you. They may be set by us or by third-party advertising partners.
We only set these cookies if you accept the "marketing" category. We currently use [ADVERTISING PARTNERS OR "no marketing cookies"].
3. How you control cookies
3.1 Through our consent banner
When you first visit the Service, we show a banner asking which non- essential categories you would like to accept. You can choose Accept all, Reject all, or open Customize to toggle each category individually. Your choice is recorded with a timestamp and applies on every subsequent visit from the same browser until you clear it or we publish a new version of this policy.
You can change your choice at any time from the Cookie preferences link in the site footer (or wherever else the cookie-reopen control is exposed on this Service). Changing your choice takes effect immediately on the next page load.
3.2 Through your browser
You can also configure your browser to block cookies, delete existing cookies, or warn you before a cookie is stored. The exact controls vary by browser; check your browser's "Settings" or "Preferences" menu for "Privacy" or "Cookies" sections. Note that blocking strictly necessary cookies will break authentication and most interactive features of the Service.
3.3 Global Privacy Control
If your browser sends the Sec-GPC: 1 header (the "Global Privacy Control" signal), we treat that as an opt-out from any cookies that would constitute a "sale" or "sharing" of personal information under applicable law. You can read more about Global Privacy Control at https://globalprivacycontrol.org.
4. Cookies inventory
Below is a representative inventory of the cookies that may be set by this Service. Names, durations, and providers may vary based on which optional features and integrations are enabled in your specific install. Administrators should review and update this section to match what their install actually uses.
Strictly necessary
| Name | Purpose | Duration | |-------------------|--------------------------------------------------------------|----------------------| | cphpfw_session | Authentication session | Session (browser close) or sliding inactivity timeout | | _token cookie | CSRF protection (where used) | Session | | cookie_consent | Records your cookie-banner choice | 12 months | | theme_pref | Persists your selected theme between sessions | 12 months |
Preferences
| Name | Purpose | Duration | |-------------------|--------------------------------------------------------------|----------------------| | locale | Persists your selected language | 12 months | | [ADD ANY OTHER PREFERENCE COOKIES HERE] | | |
Analytics
| Name | Provider | Purpose | Duration | |-------------------|---------------------------|------------------------------------------|----------------------| | [NAME] | [PROVIDER] | [PURPOSE] | [DURATION] | | [NAME] | [PROVIDER] | [PURPOSE] | [DURATION] |
Marketing
| Name | Provider | Purpose | Duration | |-------------------|---------------------------|------------------------------------------|----------------------| | [NAME] | [PROVIDER] | [PURPOSE] | [DURATION] |
5. Third-party cookies
Some cookies are set by third parties — for example, payment processors, embedded video players, customer-support widgets, or social-media plugins — when their content is loaded on the Service. We do not control those cookies. Where applicable, the third party's own privacy policy governs how they use the data they collect:
- [PAYMENT PROCESSOR NAME] — [LINK TO THEIR PRIVACY POLICY]
- [VIDEO HOST NAME] — [LINK TO THEIR PRIVACY POLICY]
- [OAUTH PROVIDER NAMES] — [LINK TO EACH]
- [ANY OTHER THIRD PARTY YOU EMBED]
We make our best effort to load third-party content only after you have consented to the relevant cookie category, but in some cases the third party may set a cookie before you have made a choice. In those cases, your browser settings remain the most reliable means to block them.
6. Do Not Track
Some browsers send a "Do Not Track" (DNT) signal. There is no industry- standard interpretation of this signal. We respond to the Global Privacy Control signal (described above) instead, which has clearer legal status under California's privacy laws and is honored as an opt-out from "sale" or "sharing" of personal information.
7. Changes to this Policy
We may update this Cookie Policy from time to time, including when we add or remove cookies. Where the changes are material, we will notify you by re-prompting the cookie banner so you can review and re-confirm your choices. The "Last updated" date at the top of this Policy indicates when it was last revised.
8. Contact us
If you have questions about this Cookie Policy or about how this Service uses cookies, contact us at:
- Email: [PRIVACY CONTACT EMAIL]
- Postal: [POSTAL ADDRESS]