Cookie Policy
Storage and external content
Carelto distinguishes necessary account/security storage from optional external visuals. Optional visuals are disabled by default. Selecting “Reject” leaves the core service available. The choices are not permission for marketing.
| Name | Purpose | Duration |
|---|---|---|
| workspace_session | Necessary sign-in cookie; HttpOnly, SameSite=Lax and Secure in production. | 7 days |
| oauth_state | Necessary security cookie for the OAuth flow you request. | 10 minutes |
| carelto-consent-v1 | Local storage recording your external-visuals choice, policy version and choice time. | 365 days; replaced when you save a new choice |
| carelto-pg-convos | Workspace conversation history in this browser. | Until removed by the feature or browser cleanup |
| carelto:help:<user-id> | Support conversation history in this browser. | Until removed by the feature or browser cleanup |
| payment-notice:<reference> | Session storage preventing repeated payment notices. | Browser tab session |
Optional external visuals
When enabled, the homepage illustration is requested from images.unsplash.com. The request reveals technical information, including your IP address, to that service. Refusing leaves a placeholder instead of the external illustration. Fonts are served from Carelto rather than Google Fonts.
Change or withdraw your choice
Use the Cookie settings control available on every page. Withdrawing stops further illustration loading and removes it from the page. Requests already sent cannot be recalled. You can also clear browser storage; this resets the choice and may delete local workspace history.
If your browser blocks storage, your choice is used for the current page but cannot be remembered across page loads. Rejecting or leaving the bar without choosing does not enable optional content.
Legal distinction
Strictly necessary storage for a service expressly requested by you is treated separately from optional access requiring consent. The relevant German rule is Section 25 TDDDG. This inventory must be checked against the final live configuration before publication.