# Cookie and Browser Storage Policy

**Platform:** MyFinalVideo (myfinalvideo.com)  
**Contact:** support@myfinalvideo.com  
**Draft revision:** 22 September 2026 — publication requires verified operator details and a check of the deployed website.

## 1. What this policy covers

Cookies store small values in your browser. The service also uses localStorage for preferences and IndexedDB for optional local video drafts. Clearing one kind of storage does not necessarily clear the others.

This draft describes the revised application. It does not assert that an older deployed page, a third-party checkout page or an extension in your browser behaves identically.

## 2. Authentication and security cookies

| Cookie | Purpose | Scope and lifetime |
|---|---|---|
| `refresh_token` | Renew the signed-in session | First party, `/api/auth`, HttpOnly, SameSite=Lax and Secure in production. Set as a browser-session cookie, without an explicit Expires or Max-Age value. The server-side refresh credential expires after 30 days unless rotated or revoked sooner. |
| `csrf_token` | Protect cookie-authenticated refresh/logout requests | First party, `/`, SameSite=Lax and Secure in production. JavaScript reads this value to submit the matching security header. Set as a browser-session cookie, without an explicit Expires or Max-Age value. |

Browser session restoration can preserve session cookies. Signing out clears these cookies and revokes the session through the server when the request succeeds. The short-lived access token is held in application memory, not saved in localStorage. Blocking authentication cookies can prevent session renewal and related account features.

## 3. Preferences and local drafts

| Storage | Purpose | Removal |
|---|---|---|
| localStorage `preferredLanguage` | Remember your language | Until changed or removed through browser site-storage controls |
| localStorage `userCountry` | Remember the account country used by the interface | Cleared on sign-out by the application or through browser site-storage controls |
| IndexedDB `MyFinalMessageDraftsDB`, `drafts` store | Save encrypted recordings/upload drafts on this browser when you choose local saving | Deleted when you remove a draft, after its successful upload, or when browser storage is cleared/evicted |

Local drafts can contain titles, recipient details and encrypted key material as well as video ciphertext. They are not a guaranteed backup. Clearing storage, using private browsing, device loss or browser eviction can remove unsent drafts. Signing out does not itself delete every local draft. Server-side account deletion cannot reliably erase copies on an offline device; remove those through that browser's storage controls.

## 4. Advertising and analytics

The revised application has no enabled Google Ads or analytics tag, including on its blog and prototype pages. Registration and purchase conversion calls have been removed. It currently has no optional-tracking consent banner or “Manage Cookie Preferences” control.

Advertising or analytics will require a separate deployment decision, an accurate updated notice and any applicable preference/consent controls before activation. There is no active optional tracker for a banner to switch off in this release.

## 5. External resources and payment pages

Some pages request fonts from `fonts.googleapis.com` / `fonts.gstatic.com` and assets from `cdnjs.cloudflare.com`. Such requests expose network request information, including an IP address, to the serving provider. An external resource request is not proof that a particular tracking cookie was set. We do not list unverified CDN cookie names or expiry periods.

Checkout pages are operated by the provider selected for the transaction. Their cookies and privacy practices are governed by the notice shown there. The previously listed `__Dodo Payments_mid` and `__Dodo Payments_sid` names and expiry periods were not verified and are not part of this inventory. Review the actual checkout page before making a payment.

## 6. Your controls

Your browser can block cookies and clear cookies, localStorage and IndexedDB for this site. Check which storage types it will remove before confirming, especially if you have unsent drafts. Clearing site storage may sign you out and reset preferences; it is separate from requesting deletion of server-side account data.

For account or privacy requests, contact support@myfinalvideo.com. The operator's verified legal identity, address and any applicable representative details must be completed before this draft is published.

## 7. Changes

Review this policy and the actual deployed storage/network behavior when authentication, drafts, external resources, checkout or tracking changes. Changes requiring user notice or consent must be handled before the relevant processing begins. A proposed future banner is not a currently implemented feature.