Cookie Policy
The essential cookies and browser storage currently used to provide authentication, security and preferences.
This document is designed to support applicable privacy obligations. Rights may vary by jurisdiction, and final legal counsel review is required before production reliance.
Current cookie position
PlayrSync currently uses essential authentication, session, security and preference technologies. No analytics or marketing script was identified in the current public application audit.
Because no non-essential cookie programme is currently active, PlayrSync does not display a misleading Accept all banner.
Authentication and session cookies
The playr_session_token cookie keeps a signed-in session available to the server. It is HttpOnly, uses SameSite=Lax, is secure in production and is configured for up to 30 days unless revoked sooner.
The Laravel session cookie supports server-side session and form security. Its default idle lifetime is configured by the deployment and it is HttpOnly and SameSite=Lax.
Security and CSRF
Laravel may use an XSRF/CSRF token cookie or session token to protect state-changing form requests. These technologies are essential and are not used for advertising.
Browser storage and preferences
Local storage currently holds the Playr API token and the mobile workspace-menu preference. Session storage can remember the page to return to after login.
Selected discovery locations are submitted as query parameters. Browser geolocation is requested only after the user activates Use my location; PlayrSync maps it to a supported city rather than exposing coordinates in public content.
Third-party checkout
The Razorpay checkout script is loaded only when a supported payment flow is initiated. Razorpay may use its own cookies or storage under its policy. Production payment activation remains pending external revalidation.
Controls and future changes
Browser settings can clear or block cookies and storage, but blocking essential technologies may prevent login, security checks or preference persistence.
If analytics, marketing or other non-essential technologies are introduced, this policy and any required consent controls must be updated before activation.
