What this notice covers
This notice explains the cookies, local storage and session storage used by madevyn.xyz and the private admin. It covers what each item does, how long it lasts and how to change your choice.
The public site asks before it measures a visit. Strictly necessary storage delivers the page, remembers a choice or protects a session. Optional analytics is off until you allow it. There is no advertising cookie, cross-site tracking pixel, third-party analytics script or session recording.
Strictly necessary and functional storage
The public site uses these first-party items:
- madevyn-theme in local storage remembers whether you chose light, dark or system. It contains the theme value only and stays until you clear it.
- madevyn-analytics-choice in local storage remembers whether you allowed or declined analytics, so the banner is not shown again on every page. It stays until you clear it or change your choice from this notice.
- madevyn-session in session storage holds a random identifier for the browser tab and the time it was created. It rotates after 30 minutes without activity and is gone when the tab closes. It is used only for analytics when analytics is allowed.
- madevyn_visitor is a first-party HttpOnly cookie set only after you allow analytics. It holds a random identifier and an HMAC signature, is Secure and SameSite=Lax, and lasts up to 180 days, refreshed when you visit. It contains no name, email address, account identifier, IP address or device fingerprint.
- madevyn_admin is a first-party HttpOnly, Secure and SameSite=Strict session cookie set only after an authorised administrator signs in. It is not set on public pages and expires after twelve hours.
Cloudflare may set a short-lived security cookie when it challenges automated traffic, and Turnstile may set necessary challenge storage on the contact page. Those items belong to Cloudflare's network security and are not used by Madevyn for advertising or profiling. The private admin also stores the session used to keep an administrator signed in. Read more in the Privacy Notice.
Optional first-party analytics
With Allow analytics, the public site sends a small event to Madevyn's own collect route. The event records the page path, a tab session identifier, the referring host, campaign source, medium and campaign name if present, an approximate country, region and city supplied by Cloudflare, a coarse device class, and the event name. The event names are page view, call to action click, form start and form submit.
A form submission event records that the form was submitted. It records no field value, no message and no email address. A visitor identifier is random and signed. The server keeps a consent record with the choice, the document version and the time. The identifier is not linked to an inquiry or to an email address.
The purpose is the studio's own aggregate measurement: which pages and calls to action help visitors, and which channels bring useful inquiries. There is no advertising, data sale, cross-site tracking, session recording, fingerprinting or automated decision about a person.
Raw events are kept for 90 days. A visitor identifier is deleted after 180 days without activity. A consent record is kept for the life of the visitor identifier and removed with it. There are no third-party analytics processors for this measurement.
What is not recorded
The analytics record does not contain your raw IP address, browser user agent, full referring address, query string, form field values, name, email address, phone number, company, project description or any special category data. The application does not create a cross-site profile and does not use the data for advertising.
Cloudflare processes request metadata as the network provider. That processing is governed by Cloudflare's own terms and privacy notice. Madevyn does not copy the raw network metadata into the analytics record.
Consent and how to change it
The banner offers Allow analytics and No thanks as equally available choices. Analytics is off by default. Declining sends no event, clears the visitor cookie if one exists, and leaves the site fully working. Allowing sets the visitor cookie and starts measurement.
You can change your choice at any time with the button in this notice. Changing the choice clears the local choice, tells the server to record a denial, clears the visitor cookie and reloads the page so the banner appears again. Events recorded before a withdrawal remain until the 90-day retention period ends unless you ask us to delete them earlier.
A choice is stored on your device and, for analytics, recorded on the server against the random identifier with a version and time. A later revision of this notice will not be treated as covered by an earlier choice where the purpose has materially changed.
Changing the choice reloads this page and shows the banner again. You can also clear this site's storage in your browser.
Network security
Cloudflare provides network delivery, bot protection and the Turnstile challenge used on the contact page. When it challenges a request, it may set a short-lived security cookie to distinguish automated traffic from a person. The item is necessary for the security of the request and is not used to advertise or profile.
The site does not enable Cloudflare Web Analytics or an advertising beacon. The only measurement is the first-party collect route described above, and it runs only after permission.
Browser controls and third parties
You can list, block and clear cookies and site storage in your browser settings. Clearing the theme choice returns the site to your system theme. Clearing the analytics choice causes the banner to ask again. Blocking the analytics item does not affect the site. Blocking a strictly necessary item may stop the theme, a form challenge or an admin session from working.
Turnstile is a Cloudflare service and may set its own necessary challenge storage on the contact page. A payment provider, bank or email client you use outside this site sets its own storage under its own notice. Madevyn does not control those services.
Changes and contact
We may update this notice when a storage item is added, removed or used for a new purpose. The version and date at the top identify the version. A new non-essential item will be named here and will not be set before you allow it.
Questions about cookies, a consent record or a privacy right go to privacy@madevyn.xyz.