Cookie & Similar Technologies Policy

GET NOTHING | Review Draft R3 / v0.3 | NOT FOR PUBLICATION
Effective: [EFFECTIVE DATE — SET AT RELEASE]

1. What is covered

This Policy describes browser/device technologies on getnothing.store and collectnothing.com, including cookies, localStorage, sessionStorage, browser identifiers, pixels and embedded third-party services. It supplements our Privacy Policy. A device-storage rule can apply even when nothing is called a cookie.

2. Source-observed first-party storage — provisional, not a production inventory

| Item | Known or indicated use | Technology | Preliminary classification | Duration to confirm | | --- | --- | --- | --- | --- | | getnothingExactBrowserId | Prevent conflicting exact-serial reservations; browser continuity | localStorage | Likely strictly necessary when exact selection used, subject to necessity assessment | Persistent until cleared; verify deletion | | getnothingExactTabId | Reservation same-tab continuity | sessionStorage | Likely necessary for exact reservation | Tab/session | | getnothingExactReservation:* | Exact-serial reservation token and reservation continuity | localStorage | Likely necessary for actively requested reservation | Flow/expiry-dependent; audit actual cleanup | | Exact-serial tab-lock keys | Protect active reservation across tabs | localStorage | Likely necessary | Flow-dependent | | getnothingRecipientLoopGiver | Preserve giver data when moving from recipient to giver flow | sessionStorage | Functional, but carries name/email; review necessity, data minimisation and clearing | Tab/session or code-cleared | | [ACTUAL CLOUDFLARE COOKIES / CHALLENGE KEYS] | Network protection, session security | Cookies or other | Verify strictly necessary scope | [ACTUAL] | | [OPTIONAL ANALYTICS LIBRARY OR PIXEL, IF ANY] | Measurement or advertising | Depends on provider | Optional unless a narrow legal exception is proven | [ACTUAL] | | Lemon Squeezy checkout mechanisms | Payment checkout provided by a separate Merchant of Record | Their domain/embedded checkout | Assessed under actual provider/browser context | Per actual checkout notices |

This list is based on the currently supplied Worker source and is not a verified browser/network inspection. Do not publish a fictitious cookie lifetime, provider or consent state. Remove unused template rows and add all real technologies before release.

3. Necessary versus optional

Strictly necessary technologies may operate without opt-in where a lawful exemption applies, but this does not make all first-party tracking necessary. Non-essential analytics, audience measurement, remarketing and similar technologies must remain inactive until an effective consent or other applicable legal permission exists. Declining optional storage must not prevent checkout and essential gift delivery.

4. Your choices

If any optional technology is deployed that requires consent, provide comparably prominent Accept optional and Reject optional controls before activation, and a persistent accessible Privacy / Cookie settings mechanism at [FINAL COOKIE SETTINGS URL] so consent can be withdrawn. Rejecting or withdrawing must stop future optional operation and be recorded accurately. If the final audit finds only genuinely necessary technology, a decorative consent banner should not be added solely to create an appearance of compliance; the required notice still remains available.

5. Providers and domain scope

Cloudflare, Lemon Squeezy and any new analytics or embedded service may have separate processing and cookie behaviour. First-party keys on one domain are not automatically available to another domain merely because they share a Worker or D1. We will document service provider, domain, purpose, lifetime and transfer/consent arrangements once verified. We will update this Policy when material technologies change.

6. Contact

[PRIVACY EMAIL]. Related: /privacy and /legal.