Session cookie
CastVero uses the first-party castvero_session cookie to associate your browser with a server-side session. It supports sign-in, form protection, language state and operational visit deduplication. The cookie contains a session identifier, not your password.
Lifetime and protections
The application sets a session cookie rather than a persistent expiry date. Browsers may restore sessions after reopening. HttpOnly and SameSite=Lax limit some forms of access; Secure is used for HTTPS deployments. Sign-out clears the session and expires the cookie.
Operational measurements
The session also supports a pseudonymous funnel identifier and deduplicated visit events. Those server-side analytics records have a separate retention period; deleting browser cookies does not erase stored records. No advertising-cookie integration is included in this release.
Browser controls
You can clear or block cookies in browser settings. Blocking the session cookie can prevent sign-in and protected forms from working. Use the privacy-request route to ask about server-side records; browser deletion and account deletion are different actions.
External services and changes
This release uses local style assets and system fonts. Hosting, CDN or integrations added by the operator may introduce other storage or data processing and must be assessed separately. Any nonessential cookie or tracking integration should be documented and obtain consent where applicable law requires it.