Last updated:
Review draft published for owner review during pre-launch; legal review remains pending. It describes the inspected application behavior; infrastructure configuration still requires confirmation.
Essential authentication and security
The customer session cookie is __Host-falcon_customer. The separate Control Center session cookie is __Host-falcon_admin and is used for administrator sign-in on the admin site. Both use Secure, HttpOnly and SameSite=Strict controls and a maximum cookie age of 12 hours; server sessions also enforce an idle limit of 30 minutes. They support authenticated access and are not advertising identifiers. Expiry of a session does not promise deletion of database or audit records.
Preferences you choose
falcon_store_preferences stores the selected market and selling currency so a valid choice can be preserved across navigation and later visits. The application sets a maximum age of 365 days, SameSite=Lax and Secure on HTTPS. The actual browser may remove it earlier. This cookie does not contain a supplier currency conversion or change product region. Owner review remains required to confirm its final consent classification and presentation under the applicable rules.
What is not a separate application cookie
The current application stores authenticated carts on the server, not in a separate cart cookie. Language is selected through localized routes and account preferences. CSRF protection uses the authenticated session and a request header rather than a distinct CSRF cookie. The inspected application does not use localStorage or sessionStorage for these features. This inventory does not rule out storage used by infrastructure features that the owner has not yet verified.
Performance measurement observed on the real site
A Cloudflare Insights performance script is present in the live storefront HTML. Cloudflare documents its RUM script as collecting page-performance information without reading or writing cookies or browser storage. Cookieless measurement is distinct from an absence of data processing. Owner review remains required to confirm the enabled Cloudflare features, actual collection scope, consent or other lawful basis, retention and transfers before approving this notice.
Optional analytics, advertising and marketing
No separate advertising or marketing cookie integration has been identified in the inspected application code. This does not mean all analytics are absent: the Cloudflare script is described above. Optional tracking technologies must be listed and reviewed before activation, with any required choice provided. A working optional-cookie consent or withdrawal control has not been established by this draft.
Managing browser storage and questions
Your browser can display, block or delete cookies. Blocking session cookies can prevent sign-in; deleting the preference cookie can reset market and currency choices. Browser deletion does not remove server-side account, support or transaction records. For privacy questions or requests, contact info@falconloot.com. The owner must verify additional Cloudflare security or challenge cookies if those features are enabled and update the inventory accordingly.