Draft — not legal advice; to be reviewed by a qualified lawyer before publishing.
Cookie and browser storage policy
Version: 2026-10-31 (draft) Effective date: [EFFECTIVE DATE — set when published] Last updated: 31 October 2026 · All changes
Castling by Cakraya is operated by Cakraya ([COMPANY LEGAL NAME]; exact registered form and SSM registration pending). This policy describes the current app's cookies and related browser storage. See the Privacy policy for message processing and other data uses.
1. Essential cookies; no advertising trackers
Castling currently uses authentication and security cookies, including short-lived OAuth connection cookies. It does not use advertising trackers or advertising cookies. Some essential cookies persist after you close the browser, as described below.
| Cookie | Purpose and when used | Lifetime |
|---|---|---|
castling_session | Maintains your signed-in hosted session. The app's browser scripts cannot read it (HttpOnly). | Up to 30 days, refreshed with authenticated use; cleared on sign-out. |
castling_csrf | Protects authenticated changes against cross-site request forgery. App scripts read it to send the required request token. | Up to 30 days, refreshed with the session; cleared on sign-out. |
castling_oauth | Signed, HttpOnly state, nonce and verifier information for Google sign-in. | Up to 10 minutes; cleared when the callback is handled. |
castling_oauth_return | Signed, HttpOnly information returning you to a connected app's authorisation request after sign-in. | Up to 10 minutes; cleared when consumed. |
castling_meta_oauth | HttpOnly state binding for a Meta account connection, scoped to /api/social/meta. | Up to 10 minutes; cleared when the callback is handled. |
castling_tiktok_oauth | HttpOnly state binding for a TikTok account connection, scoped to /api/social/tiktok. | Up to 10 minutes; cleared when the callback is handled. |
These cookies are set when their functions are used, not all on every public-page visit. Hosted production settings use Secure cookies and SameSite=Lax protections. Local development can behave differently; a local single-owner deployment does not use the same hosted sign-in flow. Browser settings, expiration and sign-out affect cookies on that browser; sign-out does not clear every other kind of site storage.
2. Local storage: preferences, activity markers and draft text
LocalStorage saves information for this site in your browser and normally persists until the app removes it or you clear it. Castling uses it for more than visual preferences: it can contain unsent message text and chat/number identifiers. People using the same browser profile may therefore see saved drafts or selections. These records are not advertising identifiers, but can still be personal information.
| Keys | What they remember |
|---|---|
castling-theme | Light/dark theme preference. |
castling-last-chat, castling-last-contact-chat | Last selected team/project chat or CRM conversation. |
castling-side-chats, castling-side-crm, castling-crm-view, castling-crm-priority | Side-panel state, list/board view and priority filter. |
castling-crm-number, castling-wa-settings-number | Selected number in CRM and WhatsApp settings. |
castling-read: followed by a conversation ID | Last locally read message marker. |
castling.draft. followed by a chat ID | Unsent composer text for that chat. Cleared when the draft is removed or sent through the composer; may otherwise persist. |
castling.draftSuggested. followed by a chat ID | Whether composer text came from an AI suggestion. |
castling.emoji.recent | Recently selected emoji. |
castling-onboard1, castling-phone-history-hint, castling-whatsnew-seen | Onboarding progress, dismissed hints and the release notice you have seen. |
castling-location-refreshed | Time of the last location refresh check; this key does not store coordinates. |
Browser preference storage is not routinely sent as a separate analytics feed. The app reads these values to operate; a saved draft is sent as message content if you submit it, and selecting chats or numbers can cause the related server requests. LocalStorage keys are not comprehensively separated by signed-in account and are not all automatically removed on sign-out, member removal or server-side data deletion. Clear site data on a shared device when finished.
3. Session storage and offline support
SessionStorage temporarily retains castling-invite-token so you can accept a workspace invitation after signing in. The app removes it in its invitation flow; it otherwise normally lasts for the tab's page session, subject to browser session restoration. Treat invitation links and tokens as private.
The installable web app's service worker caches a small offline fallback page. It does not deliberately cache your inbox, API responses, OAuth flows or chat attachments for offline reading. This does not change ordinary browser cache/download behaviour or the draft storage described above.
4. Third-party sites, referrals and your controls
Google, Meta, TikTok and other providers may set their own cookies when you visit their sign-in or connection pages; their policies apply there. The current Castling pages do not embed an advertising-tracker service. If you submit the waitlist form, it may include your page referrer and campaign parameters with your signup. This is referral collection on submission, even though it does not require an advertising cookie.
You can inspect, block or delete cookies and site storage through your browser's privacy/site-data settings. Blocking essential cookies can prevent sign-in or account connections; blocking storage can stop preferences or drafts being remembered. Clearing site data can remove unsent drafts, preferences and local read markers, and may sign you out. It does not delete server-held messages or data held by connected providers. Use [CONTACT EMAIL] for data-rights requests.
5. Changes and contact
We will update this policy if browser storage or trackers change and obtain consent before introducing non-essential tracking where the law requires it. A future product plan is not a description of cookies currently installed.
Contact Cakraya ([COMPANY LEGAL NAME]) at [CONTACT EMAIL] or [ADDRESS].