Cookie Policy

This policy describes Fapple's current practices. It is not legal advice, is not described as attorney-reviewed, and does not guarantee compliance. Qualified legal counsel should review the service and these terms as the product and geographic availability change.

fapple_age_attestation is a signed, HttpOnly, Secure first-party cookie used to enforce the 18+ entrance boundary. Eligible answers last up to 30 days; under-18 answers last up to 24 hours.

__Secure-next-auth.session-token, __Host-next-auth.csrf-token, and __Secure-next-auth.callback-url are production authentication, CSRF, and return-path cookies created as needed. Local development may use equivalent names without secure prefixes.

fapple_cookie_preference remembers Necessary only or Allow personalization for up to one year. A matching local-storage value provides interface continuity. These items are treated as essential preference and security storage.

fapple_anonymous_id is a first-party pseudonymous identifier with a maximum one-year lifetime. It is created only after Allow personalization.

fapple:analytics-session is sessionStorage used to group optional first-party analytics during one browser session. It is created only after Allow personalization and is cleared when Necessary only is selected.

fapple:muted remembers the playback mute choice. fapple:startup-gate:v1 and fapple:tap-hint-seen are session-only interface markers. fapple:recent-searches stores searches locally where search is enabled. fapple_debug_ui is a developer-only local preference and is not set during ordinary use.

fapple_ingest_session and the private library display preference are restricted to the separately protected operational ingress. Turnstile is used there for bot protection. The public age gate does not expose or replace private-ingress security.

The current public Fapple product does not include advertising pixels, targeted-advertising cookies, social tracking pixels, or third-party behavioral analytics. Video files are delivered through Cloudflare-hosted storage, and the application is hosted by Vercel; those providers receive ordinary network requests needed to deliver the service.

Optional analytics and personalization default off until Allow personalization is selected. Necessary only remains equally available in the compact preference control and account privacy settings. Refusing optional storage does not block the feed after a valid 18+ attestation.