Cookies and local storage

A cookie is a small text file that a website asks your browser to store on your device. When you return, your browser sends the cookie back, which lets the site recognise your session and remember certain choices. Cookies set by the site you are visiting are called first-party cookies; cookies set by another domain whose code runs on the page (for example, a payment provider) are called third-party cookies.

"Similar technologies" cover other ways a site can store or read information on your device, including local storage (a per-site key/value store in your browser that, unlike a cookie, is not automatically sent to a server) and session storage. We group all of these together as "cookies" in this policy for readability, but the table below tells you exactly which mechanism each item uses.

Cookies can also be described by how long they last. A session cookie is deleted when you close your browser. A persistent cookie stays until it reaches a set expiry date or you delete it.

The table below is a complete list of the cookies and local-storage items Press sets in normal operation. We do not use analytics, advertising, social-media, or any cross-site tracking cookies, and we do not sell or share personal data for cross-context behavioural advertising.

We group the technologies above into the categories below. The first two are the only categories Press currently uses.

Strictly necessary

These are required for the Site to provide a feature you have actively asked for: signing in, staying authenticated, and completing a payment safely. The service you requested cannot work without them, and we disclose them here for transparency. This category includes the Auth.js session cookie, the press_admin operator cookie, and Stripe's fraud-prevention cookies.

Functional

These remember a choice you made or support a feature, but the core service would still load without them. In our case this is the per-preview attribution cookie (press_pv_<slug>). It is non-marketing and limited to making the experience work the way you expect.

Not currently used: analytics and advertising

Press does not currently set any analytics, performance-measurement, advertising, retargeting, or social-media tracking cookies, and runs no third-party analytics tags. We do not build advertising profiles and do not sell or share personal data for cross-context behavioural advertising. If this changes, we will update this policy and introduce a consent mechanism (as described below) before any such technology runs.

Because Press currently uses only strictly-necessary and functional cookies and no analytics, advertising, or other non-essential trackers, we do not currently display a consent banner that asks you to opt in before cookies are set.

Our reasoning is as follows. The cookies we describe as "strictly necessary" exist only to deliver a feature you explicitly asked for (for example, keeping you logged in, and Stripe's fraud-prevention cookies during a checkout you initiated). The functional cookies we use are limited, first-party, and non-tracking; we provide this notice so their use is transparent, and you can refuse them using your browser controls as described below. Malaysian law does not currently impose a separate cookie-consent banner requirement; the disclosure in this policy is intended to support the Notice & Choice principle under the PDPA.

You can control and delete cookies through your browser settings. Most browsers let you view the cookies stored, delete them individually or all at once, block third-party cookies, and block all cookies. You can also clear local storage from the same settings area. The exact steps differ by browser; the help pages for the major browsers cover this:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

You can also use a private/incognito browsing window, which typically discards cookies and local storage when you close it, though this means you will need to sign in again each time.

Some browsers can send a Do Not Track (DNT) signal. There is no consistent industry or legal standard for how sites must respond to DNT, so, like most websites, Press does not currently respond to DNT signals. This has limited practical effect for our visitors because Press does not run cross-site tracking, analytics, or advertising cookies in the first place.

Some browsers and extensions can send a Global Privacy Control (GPC) signal, which is treated under the California Consumer Privacy Act (as amended by the CPRA) as a request to opt out of the "sale" or "sharing" of personal information. Press does not sell or share personal information as those terms are defined under that law, so there is currently no sale or sharing for a GPC signal to stop. If we ever introduced any data flow that qualifies as a sale or share, we would update this policy, provide the required opt-out, and treat a GPC signal as a valid opt-out request for browsers in scope.

Cookies are only one of the ways Press handles information. For the full picture, the categories of personal data we collect, the purposes for processing, the third parties we work with (including Stripe, Resend, and Google sign-in), international transfers, retention, and the privacy choices Press offers to all users as a matter of policy (including access, correction, deletion, withdrawal of consent, and obtaining a copy of your data), please read our Privacy Policy.

We may update this Cookie Policy from time to time, for example, if we add or remove a technology, if a provider changes its cookies, or to reflect changes in law or guidance. When we make a material change, we will post the updated policy on this page and, where appropriate, give a more prominent notice.

Changes take effect when the updated policy is posted on this page.

If you have any questions about this Cookie Policy or how Press uses cookies and similar technologies, contact us:

• Email (all enquiries, including privacy and data-protection requests, and legal notices): support@gopress.studio
• Registered address: available on the SSM register (Companies Commission of Malaysia)

We aim to respond within a reasonable period consistent with the PDPA.

You may also raise a concern with a data-protection authority. In Malaysia, this is the Personal Data Protection Commissioner / Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), Putrajaya.