Cookies and device storage
Last updated 5 November 2026 · 2026-11-05.v1
Cookies and similar technologies such as localStorage and sessionStorage store or access information on your device. This notice supplements the Privacy Policy and describes storage identified in the maintained application code. It is not a production browser/network audit.
1. Necessary and requested functions
Necessary authentication, login-CSRF protection, requested booking/session functions and a language preference expressly chosen by you do not require an advertising/analytics acceptance banner under article 22.2 LSSI. You can book as a guest without an account. We do not add an accept-all banner solely for those exempt functions or for analytics that the maintained code does not contain.
2. Storage inventory and current duration
| Name | Purpose and duration |
|---|---|
webdev_app_session | Cookie · first-party authentication. Secure, HttpOnly, SameSite=None, path /. Maximum age 365 days as configured in server/_core; removed on logout. This is persistent authentication, not a browser-session cookie. |
__Host-oauth_state | Cookie · random login state/CSRF protection for a requested sign-in. Set by the login code with Secure, SameSite=None, path / and no Domain; maximum 600 seconds, consumed and deleted after the callback. It is not HttpOnly. |
mvp-locale | localStorage · remembers the language you expressly choose; persists until replaced or removed. The URL determines the language of the current page. |
mvp-booking-draft-v2 | sessionStorage · unfinished booking in this tab. Removed after successful submission or at the end of the browser session; drafts older than 24 hours are not restored. |
mvp-return-to | sessionStorage · returns you to an allowed page after sign-in. Consumed on use with a 10-minute validity check, or removed when the browser session ends. |
mvp-redsys-return:<reference> | sessionStorage · retains signed bank-return parameters per booking to recover an interrupted payment verification. Removed after verified processing or when the browser session ends. Stored parameters alone never prove payment. |
mvp-guest-bookings | localStorage · recent private booking credentials, currently saved automatically by the application, up to 12 bookings with no time-based expiry. They remain until removed or displaced by newer entries. These credentials allow access: keep them private and use Forget this device on shared devices. |
manus-runtime-user-info | localStorage · the current auth hook mirrors account/runtime information, including a signed-out value, with no time-based expiry. This mirror is not demonstrated to be technically necessary and must not be treated as exempt merely because it is first-party storage. It may be recreated by active account features after clearing. |
manus-cookie | sessionStorage · platform/preview authentication fallback where supplied by the platform; current browser session, also removed on logout. Not used by the maintained application for analytics. |
app_session_id | External-platform authentication cookie, if set by that platform. The application can recognise it but does not set its domain or duration; its setter's notice applies. It is not removed by the device-storage control below. |
theme / sidebar-width | localStorage · requested theme/sidebar preferences where those components are used; remain until replaced or removed. Not advertising identifiers. |
3. Optional storage, analytics and maps
We do not claim that every current storage operation is exempt. Persistent guest remembering should be an express optional choice with a defined expiry; the unnecessary runtime-user mirror should be removed or supported by a genuinely requested function and an appropriate legal basis. The current automatic behavior is described above rather than presented as an implemented opt-in. A policy or deletion button is not a substitute for consent where consent is legally required.
No analytics or advertising script/cookie was identified in the maintained application code. Hosting/deployment injections, OAuth/payment domains and the actual proxied Maps requests need a separate production audit. If non-essential tracking is introduced or injected, it requires prior informed consent unless a documented legal exemption applies. “Cookieless” is not by itself an exemption.
Interactive Google Maps loads when requested through the configured platform proxy, which may generate platform/Google requests and disclose technical information. A proxy does not prove that no tracking or international processing occurs. Clicking Open map or allowing device geolocation is not consent to undisclosed tracking. You may provide an address and meeting instructions without enabling device location. Payment and external sign-in services have their own security technologies and notices.
Where non-exempt technology is used, it must be blocked until valid consent, with equally easy and comparably prominent accept, reject non-essential and manage choices controls, and easy withdrawal. Refusal must not prevent the core booking service. This page does not assert that a production-wide consent exemption or map audit has been completed.
4. Forget this device
This removes this site's known guest credentials, booking drafts, payment-recovery storage, language and local preferences from this browser. Save your private booking link somewhere safe first. It does not cancel a booking, delete server records, revoke a copied credential or clear HttpOnly/platform cookies. Use account logout to end an authenticated session and contact info@azulcars.com to revoke exposed booking access. The current page language stays until you navigate.
You can also clear or block storage through browser settings. Blocking necessary storage can affect sign-in, draft recovery or payment recovery. Browser settings do not replace our duty to obtain prior consent for non-exempt access. Questions: info@azulcars.com.
Read the Privacy Policy