Cookie Policy
Every cookie and browser-storage item ChaparHub uses, why it is there, how long it lasts, and how you control it.
- Effective
- Last updated
1. About this policy
This Cookie Policy explains how ChaparHub uses cookies and similar technologies on https://www.chaparhub.com and in the ChaparHub application (the "Services"). It supplements our Privacy Policy, which explains how we handle personal information generally. It is written to meet the requirements of the EU ePrivacy Directive (Article 5(3)) and the GDPR, the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR, Canada's PIPEDA, Quebec's private-sector privacy Act as amended by Law 25, and the CCPA/CPRA and other US state privacy laws.
2. What cookies and similar technologies are
A cookie is a small text file that a website stores in your browser and reads back on later visits. "Similar technologies" include the browser's localStorage and sessionStorage, which hold small values on your device, and pixels or tags, which are tiny files that report when content is loaded. In this policy, "cookies" refers to all of them unless we say otherwise.
First-party cookies are set by the site you are visiting; third-party cookies are set by another domain. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them.
3. Our approach
We use only technologies that are strictly necessary to provide a service you have explicitly requested, or to store a preference you have expressed. Under Article 5(3) of the ePrivacy Directive, regulation 6 of PECR and the equivalent rules elsewhere, these do not require prior consent. We do not use cookies or similar technologies for analytics, advertising, retargeting, cross-site tracking, profiling, or social-media integration, and we do not allow third parties to set such cookies through our Services.
If we ever propose to use a cookie that is not strictly necessary, we will update this policy first, and we will not set it until you have given prior, informed, specific and freely given consent through a control that makes refusing as easy as accepting. You will be able to withdraw that consent at any time.
4. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| chapar_session | Keeps you signed in after you complete two-step verification. Holds a random token; the server stores only its hash. Set only when you sign in. | First-party, strictly necessary. HttpOnly, Secure, SameSite=Lax | 30 days, or until you sign out |
| chapar_mfa | Links the password step of sign-in to the two-step verification step that follows it. Set only during sign-in. | First-party, strictly necessary. HttpOnly, Secure, SameSite=Lax | 10 minutes, or until verification completes |
| NEXT_LOCALE | Remembers the language you chose (English or French) so that pages are served in it. | First-party, preference (strictly necessary to provide the language you requested). SameSite=Lax | 12 months |
5. Browser storage we use
| Key | Purpose | Storage | Lifetime |
|---|---|---|---|
| theme | Remembers whether you chose the light, dark or system color theme. Never sent to our servers. | localStorage, first-party | Until you clear it or change the setting |
| Anonymous view identifier | On public post pages published through the Services, a random identifier counts a single visit to that page once rather than many times. It identifies the browser tab, not you, and is never linked to an account. | sessionStorage, first-party | Deleted when you close the tab |
6. Cookies set by others
- Cloudflare. Our network and security provider may set strictly necessary security cookies — such as __cf_bm, which distinguishes people from automated traffic and lasts up to 30 minutes — and, where a form is protected by Cloudflare Turnstile, may store a short-lived challenge token. These are used only for security and are governed by Cloudflare's own privacy and cookie policies.
- Stripe. When you pay an invoice, you are taken to a page hosted by Stripe. Cookies on that page are set by Stripe, on Stripe's domain, for payment processing and fraud prevention, under Stripe's own cookie policy. We set none of them and receive none of their data.
- Connected platforms. When you connect a social or messaging account, you sign in on that platform's own pages, which are governed by that platform's cookie policy.
7. Pixels in email
Email we send contains a single-pixel image and tracked links that tell us whether a message was delivered, opened or clicked. We use this only to measure the delivery and reach of that email, never to build a profile of you across sites. You can prevent it by turning off automatic image loading in your email client, and you can stop all marketing email with the unsubscribe link in every message.
8. Global Privacy Control and Do Not Track
We honor Global Privacy Control (GPC) as a valid opt-out of sale, sharing and targeted advertising under the CCPA/CPRA and other US state laws. Because we engage in none of these activities and use no tracking cookies, the Services behave identically whether or not your browser sends GPC or a Do Not Track signal — there is nothing to switch off.
9. How to control cookies
You can view, block and delete cookies and site data at any time in your browser's settings — usually under "Privacy", "Security" or "Site data". Your browser's help pages explain how. If you block the strictly necessary cookies listed in section 4, the public website will still work, but you will not be able to sign in, and your language choice will not be remembered.
10. Changes and contact
We will update this policy before we change the cookies or storage items we use, and the date at the top of the page will show when it last changed. Questions about this policy go to our Privacy Officer at hello@chaparhub.com.
Privacy Officer
Questions, requests to exercise your rights, and complaints about how we handle personal information. We answer within 30 days at the latest.
hello@chaparhub.com