Cookie Policy

1. What cookies do

Cookies are small values your browser stores for a website. Afnihi uses them for sessions, secure form submissions and short-lived messages. Our production session and CSRF cookies are restricted to the host that sets them; a console session is not shared with the shop or client-panel host.

2. Essential website cookies

__Host-afnihi_session

Connects your browser to its server-side session for sign-in, authorization progress and other session features. This cookie can remain for up to 28 days and persists when you close and reopen the browser. Staff sign-ins expire 28 days after successful sign-in; inactivity does not sign you out. Signing out ends your authenticated session earlier. Clearing cookies or account-security changes can also end access.

__Host-afnihi_csrf

Helps protect submitted forms against cross-site request forgery. Its configured browser lifetime is approximately one year; it can be renewed or removed earlier.

messages

May temporarily carry a success, warning or error message between pages and is cleared when the message is consumed.

Cookie names can differ in local development. These cookies are used for the requested service or security, rather than advertising.

3. Language and cookie preferences

__Secure-afnihi_language_v1 stores a supported language choice. Without remembering enabled, it is a session cookie. If you choose to remember your language, it lasts up to 180 days. __Secure-afnihi_preferences_v1 stores a signed record of your preference choices for up to 180 days, including a decision to use essential cookies only. These values are separate from sign-in and do not contain case details, documents, IP addresses or a tracking identifier.

Preference cookies can be shared across Afnihi's public, client and shop subdomains. Login and CSRF cookies remain restricted to their own hosts. Use Cookie settings in the footer to change your choice. Turning language remembering off replaces its persistent cookie with a session cookie; choosing automatic language removes the manual preference. Browser settings may also remove cookies.

On the Journal, __Host-afnihi_blog_like is saved only when you choose to like an article. This signed, host-only cookie lasts up to 180 days and lets the blog recognize repeat likes from the same browser. It does not create an account or enable advertising. The corresponding receipt stores an article reference, time and keyed hash of a random browser token, without your name, email or raw IP address. Receipt hashes and aggregate like counts remain as reader feedback after cookie expiry; removing the cookie does not remove a recorded like and may allow another like from that browser.

4. Cloudflare and external services

Cloudflare delivers and protects the site, and Turnstile helps distinguish legitimate requests from automated abuse. Depending on the enabled protection, Cloudflare may set security or challenge cookies, such as cf_clearance or __cf_bm. Their presence and lifetime depend on the feature and browser interaction. Read Cloudflare's cookie information and Turnstile privacy addendum.

The optional Cloudflare Web Analytics browser beacon is disabled, and the application does not load advertising scripts. Cloudflare still processes requests to deliver and protect the website and may maintain its own service and security metrics. Website preferences do not disable necessary network delivery or security checks.

Website fonts are served from Afnihi rather than requested from Google Fonts. External links and an optional Persona verification flow are governed by those providers' own notices.

Afnihi does not place advertising cookies or retargeting pixels through the application. Any future optional tracking that requires consent must remain disabled until the required choice is available and permission is obtained.

5. Your controls

You can inspect, block or delete cookies through your browser's privacy settings. Clearing essential cookies may sign you out, interrupt an authorization draft or prevent a form from working. Deleting a cookie does not itself delete an account, case record, uploaded file or provider-held data.

For access, deletion or other information requests, use the contact below and read the Privacy Policy. We do not treat acceptance of essential cookies as consent to unrelated processing.