Cookie Policy

1. What this policy covers

This Cookie Policy explains how PulpyWare.in uses cookies and similar browser-storage technologies (localStorage, sessionStorage, pixel tags). It is read together with our Privacy Policy — the broader picture of how we handle your personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What is a cookie?

A cookie is a small text file a website saves in your browser. On a later visit the same file can be read again. Cookies let us remember your cart between page-loads, keep you logged in to your account, and understand which products and articles people read most so we can improve them.

3. Our consent model

How analytics and marketing cookies start depends on where you are browsing from (we read the country from our CDN, Cloudflare; if it is unknown we treat you as being in India):

• Strictly necessary cookies (§4.1 below) are always set — they are technically required to load a cart, complete checkout, or stay logged in (DPDP Act §7, legitimate uses).
• In India and outside the EEA, UK and Switzerland: analytics and marketing cookies (§4.2, §4.3) are on by default and we don't show a banner. This notice tells you what they are and why we use them, and you can turn them off at any time — see below.
• In the EEA, UK and Switzerland: they stay off until you choose "Accept all" on the cookie banner. Closing the banner without choosing is treated as no consent.
• Opting out is one click, wherever you are: open "Cookie settings" in the footer and choose "Essential only". We stop the analytics and marketing tags immediately, drop any ad-click identifiers we stored, and remember your choice (existing third-party cookies need to be cleared from your browser — see §6).

4. Cookies we use

4.1 Strictly necessary (always on)

Required for the Site to function. The cart, checkout, and login flow will not work without these.

• pw_cart_id — links your shopping cart to your browser. localStorage, 30 days from last use.
• medusa_session — keeps you logged in to your account. HttpOnly cookie, 14 days from last activity.
• pw_consent — remembers your cookie choice (all or essential). Cookie, 6 months.
• pw_geo — the two-letter country code our CDN reports for your visit, used only to pick the consent default above. Cookie, 24 hours.
• pw_bypass — set only on staging / maintenance-bypass; never on production for end-users.
• CSRF tokens — short-lived per-session, used to protect form submissions from cross-site forgery.

4.2 Analytics

Used to measure which pages perform best and where visitors get stuck. On by default outside the EEA/UK/CH; there, only after "Accept all". Off for anyone who chose "Essential only".

• Google Analytics 4 — _ga, _ga_*. Anonymised page-views, session metrics and conversion events. IP anonymisation enabled. Retention 14 months (GA4 default).
• Microsoft Clarity — _clck, _clsk. Aggregate heatmaps and session replays; keystrokes inside password fields are masked at source. Retention 12 months rolling.

4.3 Marketing

Used to measure whether our ads lead to orders. Same rules as §4.2.

• Google Ads (Google LLC) — conversion measurement via the Google tag (_gcl_*). We also keep the ad-click id from the landing URL (gclid / gbraid / wbraid) in this site's own storage (pw_attribution, 30 days) so a purchase can be credited to the ad.
• Meta Pixel (Meta Platforms) — page views and shopping events (_fbp, _fbc). The same identifiers may be sent with your order to Meta's Conversions API to match it to the ad.

4.4 Functional / preferences

• pw_wishlist — your saved-products list. localStorage.
• pw_recent_pin — last PIN code you checked for serviceability, prefilled on the next product page.

4.5 Third-party cookies set when you use those features

• Razorpay sets payment-session cookies during checkout and on the hosted Payment Link page. Razorpay's cookie policy lives at razorpay.com/privacy.
• Cloudflare sets cf_* cookies as part of its CDN and Web Application Firewall protection. These are bot-mitigation, not analytics.
• YouTube embeds (if used in blog posts) set Google cookies inside the player iframe. We use the youtube-nocookie.com domain where possible to defer cookie-setting until you press play.

5. How to manage your cookies

You have two independent controls:

1. "Cookie settings" in the footer opens the cookie choices on any page: "Essential only" turns analytics and marketing off, "Accept all" turns them on. Visitors in the EEA, UK and Switzerland also see these choices on their first visit.
2. Your browser settings can block or delete all cookies. Vendor instructions: Chrome, Firefox, Safari, Edge. Note: blocking all cookies will break the cart and login.

6. Clearing third-party cookies after consent withdrawal

When you withdraw consent, we stop loading the analytics scripts going forward. Cookies that were already set by the third party (Google, Microsoft) remain in your browser until they expire or until you clear them manually. To clear them now, use your browser's "Clear cookies for this site" option in the address bar (the padlock icon).

7. Retention

• pw_cart_id — 30 days from last use.
• medusa_session — 14 days from last activity.
• pw_consent — 6 months.
• pw_geo — 24 hours.
• pw_attribution — 30 days.
• Google Ads / Meta Pixel — controlled by those providers.
• pw_wishlist, pw_recent_pin — until you clear browser storage.
• Google Analytics — 14 months (default).
• Microsoft Clarity — 12 months rolling.
• Razorpay / Cloudflare — controlled by those providers.

8. Changes

We update this policy whenever the set of cookies we use changes. The "Last updated" date at the top reflects the most recent revision.

9. Contact

Questions about cookies or your stored data: hello@pulpyware.in. For broader DPDP Act rights and the Grievance Officer, see our Privacy Policy §8 & §11.