Cookie Policy

1. Overview

This policy describes cookies, browser storage and optional measurement in the DevAura website implementation. Cookies, localStorage and sessionStorage are different mechanisms. Your browser may retain session data through tab restoration. Declining optional analytics does not stop requested form, chat, authentication or security processing described in the Privacy Policy.

2. Essential & Necessary Cookies

Authentication cookies support administrative sign-in; ordinary public browsing does not require an administrator session. Other functional browser storage remembers your choice or work in progress. Blocking storage can affect these features:

• next-auth.session-token / __Secure-next-auth.session-token: Maintains the administrator session. The application configures an eight-hour session lifetime; active session handling may refresh expiry. It is HttpOnly and uses Secure cookies on HTTPS. Logging out revokes the device session; that does not erase account or security records.
• next-auth.csrf-token / __Host-next-auth.csrf-token and next-auth.callback-url / __Secure-next-auth.callback-url: Support the authentication flow: CSRF protection and the return address after sign-in. These are session cookies by library default, not a CSRF cookie for every public contact form. Browser session restoration can retain them. Cloudflare Turnstile separately checks forms/authentication; the site does not configure a pre-clearance cookie in its widget.
• cookieConsent (localStorage): Remembers a versioned preference recognized by this application for up to 180 days from the choice. This is localStorage, not an automatically expiring cookie; expired records can remain in storage until replaced or cleared. Choices are (accepted_all, accepted_necessary, or declined_all) and invalid or expired choices require a new decision. Other functional storage: devaura_quote_in_progress (sessionStorage) saves the quote form and step, including entered personal details, until successful submission/reset or browser-session clearing; adminSidebarCollapsed (localStorage) remembers the admin layout with no application expiry. Neither is optional tracking.

3. Analytics & Performance Telemetry

We use performance analytics to understand visitor interaction, measure page speed, and improve user experience. These scripts are strictly gated and only loaded if you explicitly select "Accept All Cookies":

• Google Analytics / Google Tag Manager: Validated IDs load only after acceptance. With both GA and GTM configured, the application loads GTM only; the container controls any downstream tags. The deployed container and its cookie durations require separate review. If GA4 is deployed, its default _ga and _ga_<container-id> cookie duration is two years, configurable by the operator; this is a vendor default, not a verified inventory of this deployment. No tracking noscript iframe is loaded by this application before consent.
• Vercel Analytics: A consent-gated integration for pageviews, traffic and coarse form events. Vercel documents Web Analytics as cookie-free; enabling the endpoint/dashboard and provider retention are separate deployment settings. A package being installed does not prove collection is operational.
• Vercel Speed Insights: A consent-gated integration for real-user performance metrics including LCP, INP and CLS. INP measures interaction responsiveness; it is not a cookie or an identity field. Availability and provider retention depend on deployment settings.

4. Managing Your Preferences

You can change your consent preferences at any time. Click the "Manage Cookie Preferences" link in our website footer to reopen the panel without changing your existing choice. Choosing necessary-only or decline after acceptance saves your new preference and reloads the page to stop loaded analytics. Accessible first-party analytics storage is removed; third-party or HTTP-only cookies must be managed through your browser. Previously transmitted data cannot be recalled. Alternatively, you can block or delete cookies through your web browser settings.

5. Form and Conversion Measurement

After analytics acceptance, the application can send first form interaction, server-accepted lead and completed/partial audit events separately. Email delivery is not a lead conversion. These application-defined events omit name, email, phone, message, submitted website URL and request identifiers; they carry only the form category and audit outcome. Application pageviews strip query strings/fragments and group article/case addresses. devaura_conversion_seen_v1 in sessionStorage holds up to 256 opaque digests to suppress repeated conversions for the tab session; no earlier form activity is replayed on later acceptance. This describes application-defined payloads, not arbitrary tags an operator may add to GTM. Clearing analytics preferences does not erase server enquiry/audit records.