Cookies and similar storage
A cookie is a small value a website asks your browser to retain and send with later requests. Session storage is browser storage associated with a tab or page session. These technologies can be useful without being advertising trackers, but they can still affect privacy.
This notice covers PayEasy’s own implementation. The Privacy Policy covers the wider use of information. Stripe-hosted checkout, external stores, Telegram, and other linked services have separate practices.
PayEasy’s own storage
| Name and type | Purpose | Duration |
|---|---|---|
__Host-payeasy_sellerAuthentication cookie | Keeps a signed-in seller session. Host-only, Secure, HttpOnly, SameSite Strict. | Up to 12 hours; sign-out or revocation can end the session earlier. |
__Host-payeasy_adminAuthentication cookie | Separate administrator sign-in. Host-only, Secure, HttpOnly, SameSite Strict. | Up to 4 hours; sign-out or revocation can end the session earlier. |
payeasy-checkout-return:<checkout-id>:<result>Session storage | Remembers whether an optional checkout result return has already run, to avoid repeated automatic returns. It stores a marker, not a password, API secret, or card data. | For the browser’s page/tab session, subject to its session-restoration behaviour. |
__Host-payeasy_loginVerification proof cookie | When email verification is enabled, binds a code to the browser that requested sign-in. Host-only, Secure, HttpOnly, SameSite Strict. Contains no email or code. | Up to 10 minutes; cleared after successful verification or changing account. |
__Host-payeasy_deviceRemembered-device cookie | Set after successful email verification when “Remember this device” is selected. Allows a recognised device to request a new code after session expiry. Host-only, Secure, HttpOnly, SameSite Strict. | Up to 7 days from password sign-in. Renewal rotates the value without extending this deadline. Sign-out or revocation ends it earlier. |
__Host-payeasy_docs_stateDocumentation sign-in proof | Binds a private documentation sign-in handoff to the browser that requested it. Host-only, Secure, HttpOnly, SameSite Strict. Contains no email or password. | Up to 5 minutes; cleared after successful handoff. |
Session cookies contain opaque session values; account details and password verifiers are held server-side. Seller and administrator cookies are separate and are not deliberately shared across all PayEasy subdomains. Local development uses different, non-production cookie names.
The first-party website does not use local storage to keep passwords, PayEasy API keys, or advertising identifiers. Form text and temporary interface state may exist in page memory while the page is open.
Infrastructure and external checkout
Cloudflare delivers and protects the site. Depending on the protection applied to a request, Cloudflare may set security cookies such as cf_clearance or __cf_bm. Their presence and duration depend on the enabled feature; they are not created by our seller-account code. See Cloudflare’s cookie information for its current descriptions.
Cloudflare response headers may ask browsers to report network errors. Such reports involve technical information and are not seller login cookies. The current website does not use Google Analytics or advertising pixels. If a provider injects a performance beacon through hosting settings, it is a separate technical feature; it must be assessed for applicable notice and consent requirements. A claim that a measurement is cookieless does not mean no data is processed.
Stripe and its payment-method providers may use cookies or other technologies when you visit their hosted checkout. Their processing is governed by their own notices, including Stripe’s Cookie Policy. A PayEasy cookie setting does not control a different website.
Website fonts and brand assets are served locally by the website. Opening an external Telegram support link or provider link sends a request to that destination; those services may use their own technologies.
Optional tracking and consent
PayEasy’s current application does not implement optional advertising cookies or an “accept all” consent banner. We do not treat browsing or accepting seller Terms as consent to future advertising. Authentication, requested checkout behaviour, and proportionate security features are handled according to applicable requirements.
Before introducing non-essential storage or tracking, we must assess the applicable rules, update this notice, and provide any consent and withdrawal controls the law requires. This page is not blanket permission to add tracking.
Your browser controls
You can inspect, block, or delete cookies and site data in your browser. Deleting a seller or administrator session cookie signs that browser out. Blocking necessary cookies can prevent sign-in. Clearing checkout session storage can allow a configured automatic return to run again.
Closing a tab does not necessarily revoke a server session. Use Sign out on shared devices. Private browsing does not conceal network requests, completed transactions, or provider records. Clearing local storage does not erase financial records held on the server or a public blockchain.
Ask about the inventory or report an unexpected technology at [email protected] or @chris_payeasy on Telegram.
Questions about this policy?