Cookie notice
Every cookie and browser storage entry Castbase uses, what it does, and how long it lasts.
Business details to follow. Text in [square brackets] marks details, such as the operator’s legal name and contact people, that will be published before the public launch.
On this page 7 sections
1. In short
Castbase uses a few cookies to sign you in and protect your account, one browser storage entry for basic usage counts, and Cloudflare Turnstile to stop bots on sign-in forms. We do not use advertising cookies, cross-site tracking, or third-party analytics, and we do not sell or share this data for advertising.
A cookie is a small text file a website stores in your browser. Browser storage (local storage) works in a similar way but is only read by code running on our own pages.
2. Strictly necessary cookies
These cookies are set by our API when you sign in. The service cannot work without them, so they cannot be switched off in the app. Session cookies are marked HttpOnly (page scripts cannot read them) and Secure (sent only over HTTPS).
| Name | Purpose | Duration |
|---|---|---|
hw_access | Keeps you signed in. Holds a short-lived session token that proves who you are on each request. | 1 hour |
hw_refresh | Renews your sign-in when the access session expires, so you are not signed out every hour. Cleared when you sign out. | 30 days |
hw_csrf | Protects against cross-site request forgery: a random value our pages send back with each change you make, so another website cannot act as you. | 30 days |
hw_google_oauth | Only if you choose Google sign-in: links the Google sign-in round trip to your browser so it cannot be hijacked. Used only on the Google sign-in path. | 10 minutes |
3. Browser storage
| Name | Purpose | Duration |
|---|---|---|
hw-market-anonymous-id | A random identifier sent with first-party usage events (described below), so we can count visits without knowing who you are. It is not linked to your name or email. | Until you clear site data |
hw-market-signed-out | Remembers that you signed out on this device. Contains no personal data. | Until you sign in again |
hw-market-session | Session storage, not local storage: marks that this tab has already counted the start of a visit, so a visit is counted once. Contains no personal data. | Until you close the tab |
hw-market-cookie-session | Remembers that this browser has signed in before, so an expired session can be renewed without asking you to sign in again. Contains no personal data. | Until you sign out |
The usage events contain only the type of page viewed (for example, “catalogue” or “listing”); the length and result count of a search; at the start of a visit, the kind of place you came from (a search engine, social media, email, another site, a campaign link, or direct), never the address of that page; and which of our buttons you used, such as “Create a free account” or “Sign in to make an offer”, by a fixed name. They never include your password, sign-in tokens, email address, delivery address, or what you typed. We delete them after 90 days.
4. Cloudflare Turnstile
On sign-in and registration forms we use Cloudflare Turnstile to tell people apart from bots. It runs in a frame served by Cloudflare (challenges.cloudflare.com), not on our domain. To run its check, Cloudflare processes signals such as your IP address, browser details, and connection characteristics, and may use storage inside its own frame. Cloudflare says it uses this data to run and improve Turnstile and not to track you across sites or for advertising.
See Cloudflare’s Turnstile privacy addendum for details.
5. Google sign-in
If you choose “Continue with Google”, you are sent to Google’s own sign-in page. Google may set its own cookies there under Google’s privacy policy. We do not load Google scripts on our pages. If you do not use Google sign-in, Google sets nothing through Castbase.
6. Your choices
- Signing out clears
hw_accessandhw_refresh. - You can delete cookies and site data at any time in your browser settings. Clearing site data also resets
hw-market-anonymous-id, which starts a new random identifier on your next visit. - If you block the strictly necessary cookies, you will not be able to sign in.
If we ever add cookies that are not strictly necessary, such as advertising or third-party analytics, we will update this notice first and ask for your consent before setting them.
7. More information
The privacy notice explains how we handle personal data generally. Questions about cookies: [privacy email address].