Cookie Policy
Version 0.1.0-draftUpdated 24 October 2026
Draft — under legal review. Not legal advice and not yet in force.
Highlighted notes like [VERIFY: …] and blanks still to be filled in show this is a working draft.
On this page
Version 0.1 (draft) · Effective: {{EFFECTIVE_DATE}} · Last updated: 24 October 2026
In short (plain language)
- We use only strictly necessary cookies and browser storage — to keep you signed in, protect your account, stop bots, and remember a few small preferences.
- No advertising cookies. No tracking across websites. No third-party analytics. No social-media pixels.
- Because everything we use is necessary for the Service to work, we do not show a cookie banner. If we ever want to use an optional cookie, we will ask you first.
1. What cookies and browser storage are
A cookie is a small text file a website saves in your browser. Browser storage (localStorage and sessionStorage) is similar but is never sent to our servers automatically. Our mobile app stores the equivalent sign-in data in the phone's secure storage.
2. Cookies we set (DamruVani, first-party)
On our live site the names carry the __Host- or __Secure- prefix, which means the browser accepts them only over HTTPS and only for our exact domain.
| Name | Purpose | Lifetime | Readable by page scripts? |
|---|---|---|---|
__Host-at | Keeps you signed in (short-lived access token) | 15 minutes | No (httpOnly) |
__Secure-rt | Renews your sign-in securely; sent only to our sign-in endpoints | Up to 14 days (sessions end after 30 days at most) | No (httpOnly) |
__Host-csrf | Protects your account against cross-site request forgery | Same as your sign-in session (up to 14 days) | Yes — by design, so the page can send it back with each request |
__Host-has_session | Tells the site you have a session (contains only "1", no personal data) | 30 days | Yes |
__Host-oauth | Protects the "Sign in with Google" step against tampering | 10 minutes | No (httpOnly) |
__Host-link (planned) | Protects the step that links a Google account to an existing email account | 10 minutes | No (httpOnly) |
We set no cookies on our API domain (api.{{DOMAIN}}); API clients use API keys instead.
3. Browser storage we use
| Key | Where | Purpose | How long |
|---|---|---|---|
dv_intro_seen | localStorage | Remembers that you have seen the intro animation, so it does not play every time | Until you clear site data |
dv_intro_sound | localStorage | Remembers whether you turned the intro sound on | Until you clear site data |
dv_studio_voice | localStorage | Remembers the last voice you picked in the Studio | Until you clear site data |
dv_login_email | sessionStorage | Keeps the email you typed while you enter the sign-in code, if you refresh the page | Until you close the tab |
dv_otp_resend_at | sessionStorage | Remembers when you may request a new sign-in code | Until you close the tab |
Your sign-in code itself is never saved in browser storage.
4. Third-party cookies
| Provider | When | Purpose | Notes |
|---|---|---|---|
| Cloudflare | Across our site | Security: protects against DDoS attacks and bots. If Cloudflare's bot protection or a security challenge is active, it may set cookies such as __cf_bm or cf_clearance | Strictly necessary for security [VERIFY: exact cookie names and lifetimes in Cloudflare's documentation at launch] |
| Cloudflare Turnstile | Sign-in and sign-up pages | Checks that you are human without a puzzle | Loaded from challenges.cloudflare.com [VERIFY: whether Turnstile sets cookies or storage] |
| Only if you choose "Sign in with Google" | Google's sign-in page sets its own cookies on Google's domains | Governed by Google's privacy policy | |
| Razorpay | Only on checkout pages, once paid plans exist (test mode during the beta) | Payment processing and fraud prevention | Governed by Razorpay's privacy policy [VERIFY: Razorpay Checkout cookies] |
5. What we do not use
- Advertising or retargeting cookies
- Third-party analytics (for example Google Analytics) or session recording
- Social-media pixels or "like" buttons that track you
- Fingerprinting for advertising
6. Your choices
You can block or delete cookies in your browser settings. If you block the cookies in §2, you will not be able to sign in or use the Studio. Clearing browser storage resets the small preferences in §3.
7. Changes
If we change the cookies we use, we will update this page and its version. We will not add any cookie that is not strictly necessary without first asking for your consent.
Questions: grievance@{{DOMAIN}} · Privacy Policy