VARAPER / PRIVACY
Cookie Policy
Updated 17 October 2026
This policy explains cookies and similar browser storage on VaraPer. The controller is Mahsa Shaghaghi, personally operating VaraPer in Italy. Contact varaper.co@gmail.com. The Privacy Policy explains broader data processing and your rights.
Your choice
Google Analytics 4 does not load before analytics consent. The banner offers Accept all, Reject non-essential and Manage preferences. Accept all enables the optional analytics category; Reject non-essential keeps it off. Manage preferences lets you choose and save. You can change or withdraw consent at any time using Cookie settings at the bottom of the page. Using the website, subscribing and submitting a review do not require analytics consent.
Essential storage supports the requested service, security and remembering your choice. Cookies are stored by the browser; localStorage persists across visits, while sessionStorage normally lasts for the tab session. You can also clear or block storage through your browser. Blocking necessary security resources or storage may prevent a form from working.
Consent preference — essential
varaper-cookie-consent is a first-party localStorage record, not a cookie. It stores the consent version, whether analytics is accepted, and saved/expiry timestamps. The preference is valid for 180 days. After expiry the website treats it as invalid and asks again; the browser may retain the expired record until it is replaced or cleared. A rejected choice is remembered on the same basis. If storage is unavailable, the choice may apply only to the current page and the website displays a notice.
Google Analytics 4 — optional
After analytics consent, the Google tag for G-V6DHZBE7YK loads from www.googletagmanager.com. Google measures website usage and may set first-party _ga and _ga_V6DHZBE7YK cookies for browser identification and session/measurement state. Our configured expiry is 180 days; Google may renew cookies on use, so this is not a fixed limit from the first visit. Analytics can send page, usage, browser and device information to Google, which may process data outside the EEA.
An accepted email submission can send a generic sign_up event when analytics consent is granted. The custom event does not include the email address or form/token data. Advertising storage, advertising user data and advertising personalisation remain denied. We do not load GA4 to send cookieless analytics before consent.
When analytics is withdrawn, the site disables analytics, deletes recognised readable Google analytics cookies for its domain/path combinations and reloads the page to unload previously loaded Google code. This does not erase data already lawfully received by Google. See Google's Privacy Policy and how Google uses information from partner sites.
Signup duplicate prevention — analytics-consent session storage
varaper-email-signup:<random UUID> is a first-party sessionStorage flag used to prevent repeated analytics callbacks for the same accepted submission. When analytics consent permits the event, it records “sent”; it contains no email address or CAPTCHA token and lasts for the tab session. An in-memory guard also prevents duplicate calls.
Brevo and Invisible Cloudflare Turnstile
The Early Access form uses Brevo's form script and delivery service, external Brevo styling/fonts, and Cloudflare Turnstile verification in Invisible mode. These form/security resources can load when the form is displayed independently of optional GA4 consent. Turnstile supplies a short-lived verification token in a hidden form field; that token is not itself a cookie and is not stored by VaraPer as an analytics identifier.
Brevo, Cloudflare and hosting/security layers may use provider-managed storage or cookies needed for service delivery, verification or anti-abuse controls. Their names and lifetimes depend on the provider and enabled features; this notice does not assert that every provider cookie is set on every visit. In particular, a Cloudflare clearance cookie depends on clearance/challenge configuration, rather than being an automatic consequence of every Turnstile widget. See the Cloudflare Turnstile Privacy Addendum and Cloudflare's cookie documentation.
Reviews, hosting and private administration
Public review code does not add a separate advertising or analytics cookie. Review text and media are stored on the server, not as browser cookies. Hosting/security providers can maintain technical logs separately from browser storage. The private owner moderation area uses Sites/ChatGPT authentication; provider-managed authentication cookies may be needed when that sign-in is used. Visitors do not need owner sign-in to subscribe or read reviews.
Email tracking is separate
Brevo email-open pixels and tracked email links are distinct from cookies on this website. Website analytics consent is not separate permission for those email-tracking activities. The Privacy Policy explains the current email-tracking context.
Questions and changes
For questions or data-protection requests, contact varaper.co@gmail.com. We update this policy when relevant storage practices change.