Review draft · Version 0.2-review
Cookie and Browser Storage Policy
Last updated: · Effective date: [Approved effective date — to be confirmed]
1. Who we are and what this policy covers
Legal seller: [Legal seller / owner name — to be confirmed]. Business address: [Complete business address — to be confirmed]. This policy covers application storage on the website origin you visit, including customer features and separate administrator storage. Browser scope depends on the actual hostname, scheme and port; apex and www storage need not be shared. See Privacy Policy and the contact directory.
2. Storage explained in plain language
Technology What it means
| Cookies | Small pieces of information stored by your browser. Relevant cookies are sent with matching website requests. They may expire after a set period or when a browser session ends. |
|---|---|
| Local storage | Information that website scripts can read on the relevant website origin. It can remain between visits and has no built-in expiry. The application or browser must remove it. |
| Session storage | Information associated with a website and browser-tab page session. It generally ends when that tab’s page session ends; it can survive reloads and may be restored by browser session recovery. |
| Other technologies | Tracking pixels, embedded content, device fingerprinting, IndexedDB or service-worker caches may also store or access information. [Whether any are used on the live site; if none, state that after verification — to be confirmed]. |
3. Why the application uses storage
The audited application uses storage to maintain a guest cart, support customer and administrator login, secure the Google sign-in callback, remember storefront navigation and reduce repeated checkout submissions. The following inventories explain each item and its source-based lifetime. Classification and duration must be assessed for the actual purpose and applicable law; “functional” does not automatically mean exempt from consent.
4. Cookie inventory
The following source inventory lists identifiers by name, never their secret values. Cookies are HttpOnly. Host/domain, actual HTTPS attributes and hosting-added items require a deployed browser check. Customer/cart/OAuth source settings use Secure and SameSite=None for HTTPS; administrator cookies use SameSite=Lax. HTTP development behavior differs.
| Cookie | Purpose / scope | Source lifetime |
|---|---|---|
| kisan_cart | Guest cart continuity; path / | 30 days; may be renewed when set |
| kisan_session | Customer session; path / | Linked to session expiry; SESSION_TTL_DAYS defaults to 30 days. Idle/absolute server limits can end access earlier. |
| kisan_admin_session | Administrator session; path /api/v1/admin | Linked to server session expiry |
| kisan_oauth_verifier | Google callback security; path /api/v1/auth/google/callback | Configurable state TTL, default 10 minutes; cleared by callback handling |
5. Local storage and session storage inventory
Website scripts can read these entries. Local storage has no built-in expiry; server validity can end earlier. Session storage generally lasts for the tab’s page session and may survive browser session restoration.
| Entry / technology | Purpose | Removal / lifetime |
|---|---|---|
| kisan_cart_token / local storage | Guest cart API token | Removed when the application clears cart credentials; otherwise browser removal, no automatic browser TTL |
| kisan_session_token / local storage | Customer bearer token | Customer sign-out or stale/revoked credential cleanup; otherwise browser removal |
| kisan_admin_session_token / local storage | Admin bearer token | Admin sign-out or stale/revoked credential cleanup; otherwise browser removal |
| kisan-last-storefront-page / session storage | Return navigation | Overwritten on qualifying storefront navigation; tab session |
| kisan_checkout_<customer>_<cart> / session storage | Checkout idempotency key | Tab session; not a permanent policy-consent record |
6. Information contained in storage
The reported items contain or represent cart/session identifiers, authentication tokens, temporary sign-in security information, navigation state and checkout request identifiers. Identifiers can be personal information when linked to an account or order; they are not automatically anonymous just because a customer’s name is absent.
[The information type in each deployed item and whether any additional identifiers or customer details appear in keys or values. do not insert real token values — to be confirmed]. Cart contents, order addresses and payment records held on our servers are covered by the Privacy Policy rather than being treated as browser storage solely because this policy lists a cart token.
7. Storage categories and current status
Cart, authentication, Google callback, navigation and checkout entries support requested application functions. Duplicate token storage and retention still need a necessity/security review. No separate language/theme preference key, analytics SDK, advertising pixel or cookie-consent record was found in source. Deployed hosting/CDN scripts remain unverified.
8. Third-party services and external websites
Google sign-in redirects to Google, whose own privacy/storage practices apply there. External bank/UPI apps and clicked links have their own policies. Current WhatsApp controls are development demos; they do not create orders or support tickets. No embedded analytics/advertising widget was identified in source.
Provider links: https://policies.google.com/privacy (opens a new tab) and https://www.hostinger.com/privacy-policy (opens a new tab) Actual hosting/CDN/security-added cookies and scripts: [Actual hostinger / cdn / security providers and their verified cookie or storage details, or confirm none are added — to be confirmed]. Source inspection cannot establish the contents of the deployed Hostinger page; confirm them before final publication.
9. Consent and website preference controls
No in-site optional-cookie preference banner/control is currently implemented, and no optional analytics/advertising SDK was identified in source. We do not add an “Accept all” button that falsely claims to block technologies. Whether consent is required depends on the actual deployed technology, purpose and applicable law.
Before enabling any technology requiring prior consent, implement script/storage blocking, equivalent accept/refuse choices, withdrawal and a proportionate choice record. Reading this policy, scrolling or agreeing to terms is not optional-tracking consent. Browser site-data controls below remain available.
10. Managing storage through your browser
Browser settings usually let you inspect or remove site data, restrict cookies and choose how third-party storage is handled. The labels differ across browsers and devices. To clear this website’s storage:
• Open your browser’s Settings and find Privacy, Site settings or Website data.
• Find our actual website hostname and choose its cookie/site-data controls. If we use multiple hostnames, review each relevant hostname.
• Select the option to clear site data, including cookies and local storage where offered. Deleting cookies alone may leave local storage behind.
• For tab-session information, close the relevant tabs or use available site-data controls; browser session restoration may restore a page session.
• On a shared device, sign out first and avoid sharing passwords or tokens. Browser settings and sign-out are complementary controls.
Private browsing may limit persistence after a private session ends, but it does not make you anonymous or prevent the website from receiving information while you use it. [Current help links for the browsers you choose to support — to be confirmed].
11. What changes when storage is blocked or cleared
Action Possible effect
| Clear cart storage | Guest-cart continuity may be lost or a new cart created. This does not cancel an accepted order. |
|---|---|
| Block login/sign-in storage | Login, Google callback validation or authenticated functions may fail; you may need to sign in again. |
| Clear navigation/checkout state | Return navigation may reset. A previously submitted checkout request must still be checked against server order status before you submit or pay again. |
| Clear admin storage | Authorised administrators may need to authenticate again. Ordinary customers do not need administrator storage. |
| Reject optional tracking, if used | Core shopping should remain available except where a separately requested optional feature genuinely depends on that storage. [Actual behaviour — to be confirmed]. |
12. Browser removal and server retention are different
Clearing browser storage, signing out, cookie expiry and server-record erasure are separate. Clearing site data does not cancel an order, refund money or erase orders/backups. Deactivation revokes account sessions and releases active cart holds but keeps historic records.
Privacy requests: [Working privacy email — to be confirmed]. Approved retention, erasure and backup handling: [Category-specific retention and purge schedule — to be confirmed] / [Backup retention and restore handling — to be confirmed]. A removed local token is not proof that all copies of associated data have been deleted.
13. Updates to this policy
Version and update date appear on this page. Effective date: [Approved effective date — to be confirmed]. Recheck the inventory and controls before introducing new scripts, storage or providers. Material changes and any new required permission must be addressed before enabling the affected technology.
14. Questions, complaints and contact
Questions about browser storage and privacy: [Working privacy email — to be confirmed]. Grievance Officer: [Grievance Officer name and designation — to be confirmed] / [Working grievance email — to be confirmed]. The business identity and full contact directory are available through Policies & Customer Care; unconfirmed fields are visibly marked.