Cookie Policy

1. General Information

Pasha uses HTTP cookies, local storage and session storage. This inventory explains what the current application writes, why it is needed and when optional analytics can load.

2. Storage Inventory

• accessToken: httpOnly authentication cookie backed by a token that expires after 15 minutes. It is sent only to paths below /api and is a session cookie unless “Remember me” is selected.
• refreshToken: httpOnly authentication cookie. It is a session cookie with a token lifetime of up to 24 hours, or persists for up to 30 days when “Remember me” is selected. It is sent only below /api/auth for the refresh and logout lifecycle.
• pasha_session: httpOnly security-session cookie, up to 24 hours; used for request protection and server-side session state and sent only below /api.
• cookie_consent and cookie_preferences: browser local-storage records containing your consent status and category choices; retained until you clear site data or update the preference.
• Functional caches and navigation state: browser local or session storage used for recent interface state and short-lived public-data caches. Current public-data cache entries expire after no more than five minutes. A route-boundary focus entry may temporarily hold only a destination pathname for one navigation; it does not store a query string, fragment or authentication token.
• pasha_marketing_utm: session-storage attribution record containing campaign parameters and the landing pathname. It is written only after analytics consent and lasts no longer than the current browser tab.
• Google Tag Manager and analytics: Google code is not loaded until analytics consent is granted. Consented events may include the page pathname, campaign source/medium/campaign, whether a search was present and a search-length range; raw search terms are not sent by Pasha's event layer. Google may then set or read identifiers as configured in the connected analytics container.
• Operational client telemetry: when enabled, sanitized runtime and API-failure events use an in-memory session identifier. That identifier is not written to cookies, local storage or session storage.

3. Cookie Security

4. Cookie Management

5. Legal Compliance

Essential storage is used to provide authentication and security. Optional analytics requires a recorded choice before its loader runs. The applicable legal basis depends on the user's location and the specific processing purpose. For more information, review our Privacy Policy.

6. Changes to This Policy

Changes are published with a new version and effective date. A material change to an optional category will not override your existing choice without a new preference action.

7. Contact