Cookie Policy

1. Scope and relationship with the Privacy Policy

This Policy explains how Pulscam uses cookies, localStorage, sessionStorage and similar browser technologies for authentication, security, adult-access controls, preferences and platform operation.

It supplements the Privacy Policy. Where a browser identifier or stored value is linked to an account, device or identifiable person, the Privacy Policy also applies.

2. Storage categories

3. Current source-level inventory

The current source inventory includes both cookies and Web Storage. Active or supported items include:

• pulscam_age_gate_accepted_v1 in localStorage and a first-party cookie for adult-access acknowledgement; the cookie is configured for up to 365 days.
• pulscam_cookie_consent_shadow_v1 in localStorage and cookie form for the saved consent choice; the cookie uses a 180-day Max-Age.
• __Host-pulscam_analytics_consent_v1, a Secure SameSite=Lax proof of the saved Analytics choice, configured for 180 days.
• pulscam_homepage_turnstile_grant_v1, a Secure HttpOnly SameSite=Strict 24-hour homepage-entry security grant.
• pulscam_friends_page_jwt, a Secure HttpOnly SameSite=Strict token scoped to /friends and expiring with its signed token.
• pulscam_affiliate_referral, a Secure HttpOnly SameSite=Strict signed referral-attribution cookie with a 30-day maximum lifetime, preserving the first valid referral state after Marketing consent.
• __Host-pulscam_marketing_consent_v1, a Secure SameSite=Lax first-party proof cookie recording whether the current Affiliate Attribution disclosure has Marketing enabled or disabled; configured for 180 days.
• __Host-pc_session_v1, Secure HttpOnly SameSite=Strict primary-auth support used in the ongoing controlled migration. It is not yet universal across all authenticated surfaces.
• legacy/fallback authentication tokens in localStorage on multiple current authenticated surfaces while the HttpOnly migration remains incomplete.
• broadcast client/session identifiers and device preferences, VIP anonymous-display preferences, account-tab state, dismissed safety notices, private-chat state and other requested interface preferences.
• short-lived sessionStorage values for ticket/show flow coordination, processor-review order state and similar single-session operations.
• pc_admin_stepup_v1 and other privileged-interface security storage for authorized administration flows.

Presence in source code does not mean each item is written for every user or route. Pulscam must continue to reconcile source, browser runtime and provider behavior before production launch.

4. Strictly necessary storage

Strictly necessary storage may operate without an optional-cookie choice only where it is genuinely required to provide a feature requested by the user, maintain authentication or account security, remember the adult-access decision, preserve the user's consent selection, support fraud prevention or protect a requested transaction or form.

Examples currently used for security or requested functionality include the homepage Turnstile grant, scoped authenticated-session support, Friends-page authentication, administrative step-up protection, account-deletion cancellation state and the age/access acknowledgement.

Disabling or clearing necessary storage may sign the user out, reset age or consent choices, disable security controls or prevent requested functionality.

5. Preference storage

Preference storage may remember selected account tabs, interface state, device or broadcast choices and whether a safety notice was dismissed.

Preference storage that is not strictly necessary must remain subject to the applicable consent choice. A setting must not be classified as necessary merely because it is convenient.

6. First-party Analytics, affiliate attribution and marketing status

Pulscam's first-party Analytics is optional and loads only after the user affirmatively enables the Analytics category. Rejecting Analytics does not block the core service.

When enabled, first-party Analytics may measure page views, sessions, acquisition source and product engagement using random browser identifiers. The server stores pseudonymous HMAC-derived values rather than the raw browser identifier.

The affiliate referral system is operationally separate from the optional Analytics collector. Pulscam classifies its first-party affiliate/referral attribution cookie under the optional Marketing category. The server will not write or use pulscam_affiliate_referral unless the current Marketing-consent proof is affirmative.

If a visitor arrives through an eligible affiliate link before making a cookie choice, the referral code may be carried temporarily in the URL fragment. The fragment is not sent to the server as part of the HTTP request and is removed after the consent decision is processed. If Marketing is accepted, Pulscam performs a same-origin capture and may set the 30-day HttpOnly referral cookie. If Marketing is rejected or later withdrawn, the pending referral is discarded and the referral cookie is cleared or treated as unusable.

Refusing Marketing does not prevent login, account creation, viewing, creator access or other core platform functionality. Other marketing storage remains disabled unless separately activated, documented and covered by the applicable consent.

7. Consent banner and choices

The consent interface offers Accept all, Reject optional and Settings. Necessary storage remains available because it supports core security and requested functions. Affiliate/referral attribution is controlled by the optional Marketing toggle and is off when optional storage is rejected.

Consent for optional storage must be a clear affirmative choice, must not be preselected and must be as easy to withdraw as to give. A refusal must be recorded without activating the refused category.

For server-side Analytics consent enforcement, the consent component uses the first-party cookie __Host-pulscam_analytics_consent_v1. It records the current consent version and whether the Analytics category is enabled or disabled. It is used to verify the Analytics choice before the server accepts Analytics events. The cookie uses Secure, Path=/ and SameSite=Lax.

8. Changing or withdrawing choices

Users may change optional-cookie choices through the available cookie settings. They may also clear browser storage through browser controls, although this can sign them out or reset preferences.

Withdrawal applies to future optional processing and does not make earlier lawful processing unlawful. Pulscam must stop or disable the relevant optional integration after the withdrawal is recorded, subject to reasonable technical propagation.

If Analytics consent is withdrawn, the Analytics consent proof is changed to the disabled state immediately, pending unsent Analytics events are discarded and the Analytics visitor and session identifiers are removed from browser storage. Resetting the consent record deletes the Analytics consent proof cookie. The general consent shadow cookie by itself does not authorize Analytics.

9. Duration and retention

Current first-party durations confirmed from source include: age-gate cookie up to 365 days; consent-shadow cookie 180 days; Analytics proof cookie 180 days; Marketing-consent proof cookie 180 days; homepage Turnstile grant 24 hours; affiliate referral cookie 30 days after consent; administrative step-up generally 30 minutes by current default; and scoped authentication cookies until their signed-token expiry.

Web Storage values may instead persist until replacement, logout, expiry logic, account action or manual clearing. Some sessionStorage values end with the browser session.

For first-party Analytics, raw Analytics events are retained for up to 30 days, Analytics sessions for up to 90 days, and pseudonymous visitor and visitor-day records for up to 395 days under the current Analytics policy/runtime.

Before production launch, Pulscam must maintain an approved inventory stating the name or category, provider, purpose, storage technology, first- or third-party status, duration, legal basis or consent category and removal trigger for each production item.

10. Third-party and provider storage

Security, streaming, communications, payment, payout or identity providers may introduce their own cookies or browser storage when their functionality is used. Payment-provider storage is provider-dependent and will be documented after each provider is selected and integrated.

Pulscam must not classify a provider's optional analytics or marketing technology as necessary merely because it is bundled with a provider product.

11. Anonymous-route scan and authenticated flows

The latest unauthenticated HTTP scan did not observe a Set-Cookie header on the sampled public routes. This does not prove that authenticated, checkout, streaming, security or provider flows never set cookies or other storage.

Production disclosure must be updated from browser and network evidence covering login, signup, viewer activity, creator activity, checkout, payout, support and consent-choice flows.

12. Security and prohibited uses

Pulscam may use necessary browser identifiers and device or network signals for authentication, account protection, fraud prevention and enforcement. Such information must not be repurposed for unrelated advertising without an appropriate legal basis and notice.

Pulscam does not authorize storage technologies for covert cross-site tracking, sale of sensitive adult-interest profiles or unrelated inference of sex life or sexual orientation.

13. Contacts and review status

Questions about cookie settings or browser-storage behavior may be sent to support@pulscam.com. Legal and privacy notices may be sent to legal@pulscam.com.

This Policy remains a pre-launch compliance version until the legacy-token/HttpOnly migration, production provider storage, authenticated browser tests and final operator details are resolved. The first-party Affiliate Referral consent gate described above is part of the current prepared runtime architecture and must remain covered by regression testing.