CLOUDNRJ / Storage & cookies
Storage & cookies
Storage inventory, duration and your controls.
Updated: 8 October 2026
1. Scope
This policy distinguishes browser storage from server processing and covers theme, cart, domain selection, legacy drafts and form security. It complements the privacy policy.
Deployed public code contains no third-party advertising or audience-analytics tracker. The assistance button opens a ticket, not live chat or an AI service.
2. Technology differences
Cookies may accompany requests to the relevant server. localStorage and sessionStorage are available to same-origin scripts and are not automatically attached to every HTTP request.
localStorage persists until changed or cleared. sessionStorage normally follows a tab session, but browser session restoration can preserve it. Closing a window does not always erase every item.
3. Theme inventory
cloudnrj-theme uses localStorage for light or dark after you choose a theme. The site defines no automatic expiry; the value remains until overwritten or cleared.
Without a stored choice, browser colour preferences may be used for display, not advertising profiling.
4. Cart and domains inventory
cloudnrj-cart-v1 uses sessionStorage for product identifiers, billing cycles, domain names and service/domain links, limited to 32 items. cloudnrj-domain-selection keeps up to 32 names to transfer to checkout.
Both follow the browser session, subject to restoration. Billing contact and card data are not stored in these keys. Clearing them removes a selection, not a confirmed transaction.
5. Legacy drafts inventory
cloudnrj-support-drafts uses sessionStorage for older subjects, dates and summaries which may contain contact information. The draft page allows reading, deletion or download, with a maximum of 20 entries.
These are separate from the current server-submitted ticket form. Local deletion does not erase sent mail. Take care on shared devices.
6. Security cookie inventory
cloudnrj_support is a session cookie scoped to /api/. It holds a session identifier rather than a message body and supports form tokens and duplicate prevention. It uses HttpOnly, SameSite=Strict and Secure when the server recognises HTTPS.
The cookie follows the browser session. Server session lifetime is configured at two hours; submission tokens expire after one hour. Physical cleanup depends on the session handler and is not guaranteed to coincide with functional expiry.
7. Server records
Ticket anti-abuse counters use an IP-derived hash and one-hour windows; expired entries are removed on subsequent requests. Domain availability responses are cached for 60 seconds, with request limits. These are not advertising cookies.
Caches, sessions and hosting logs differ from browser storage and may persist after a tab closes. Counter windows do not describe mailbox or hosting-log retention.
8. External services
Domain queries pass through the server to Honline or the relevant WHOIS/RDAP registry. These server exchanges do not themselves set third-party browser cookies. External links lead to services with their own policies.
Cloudflare Turnstile loads only when enabled in configuration, then communicates with Cloudflare for anti-abuse verification. Integrations require appropriate information and consent where applicable.
9. Necessity and consent
Requested carts and form security serve functional purposes; legal classification depends on actual use, not a label or first-party status. Theme storage records an explicitly selected preference.
Continued browsing is not agreement to advertising or analytics. Consent-dependent technologies must remain off pending the required choice, with refusal and withdrawal as accessible as acceptance.
10. Clearing and blocking
Remove cart items, delete drafts or clear site cookies and data in browser settings. Clearing also resets the theme and applies separately to each device and browser.
Blocking storage may break cart persistence or ticket submission. Email help@cloudnrj.com instead if needed. Local deletion does not cancel contracts or erase messages already received.
11. Shared devices and updates
Others using the same browser profile may access stored data. Clear site data on shared devices and avoid secrets in searches or drafts.
This inventory must follow tool changes. Send questions with the storage name and page, without disclosing confidential cookie values or session identifiers.