What is used today
The application uses session and security cookies for requested functions. Language follows the browser. It has no advertising, Google Analytics, external videos or active social sign-in. Review of public pages and the demo did not observe optional cookies; this finding covers the tested operation, not every possible security challenge.
Session cookies
__Host-cp_demo: first-party, HttpOnly, Secure, SameSite=Lax. Created when you enter the demo to recover your fictitious workspace. Duration: up to 24 hours.
__Host-cp_session: first-party, HttpOnly, Secure, SameSite=Lax. Authenticates your session. Cookie duration: up to seven days; demo access ends no later than the workspace’s 24-hour expiry. An expired session cookie does not grant continued access.
__Host-cp_studio: first-party, HttpOnly, Secure, SameSite=Lax. Keeps a private studio account signed in for up to seven days, separately from the demo.
__Host-cp_auth_flow: first-party, HttpOnly, Secure, SameSite=Lax. Connects a registration or recovery request to the browser that started it. Up to one hour; cleared when the callback finishes.
__Host-cp_recovery: first-party, HttpOnly, Secure, SameSite=Lax. Allows a verified password-recovery flow to set a new password. Up to ten minutes; it does not provide ordinary studio access.
Automatic language
The page follows your browser’s language preferences, falling back to English. There is no language selector or new persistent local language preference; previous cp-language entries are removed. IP geolocation is not used. On registration and sign-in, the language code may be saved in account metadata to localise transactional emails.
Necessary cookies and voluntary measurement
Necessary session and security cookies support requested functions and do not need a general Accept all button. This does not exempt all measurement from consent: Character Path activity measurement remains off until you allow it in your account.
Refusal does not restrict your projects. Change your choice and erase usage history in Account. No third-party analytics cookies are added; optional processing still requires your choice when using the existing session.
How to manage them
Change your preferred languages in your browser settings. Clearing browser data for thecharacterpath.com may sign you out and disconnect your temporary demo workspace.
Signing out invalidates that session and removes its cookie but does not necessarily remove the demo visitor cookie. Blocking necessary cookies prevents the application from keeping you signed in.
Owner and contact
Owner: Hector Riera Maiques. Cookies and privacy enquiries: thecharacterpath@gmail.com. This policy covers current service technologies. Information and any necessary consent must precede introduction of additional optional technologies.
Cloudflare protection
Traffic passes through Cloudflare. Its controls may use technical cookies when a challenge or protection requiring them is triggered. None were observed in the reviewed ordinary flow. If an additional feature is configured, this inventory will be updated before use; non-exempt technologies will require the relevant consent.
Optional usage measurement
Optionally share active days and approximate time in the app. The owner sees aggregate statistics, not your private content. No external analytics or additional cookies. Data is kept for 90 days in the service. You can disable this in Account and erase your usage history.
Measurement is off until you accept. We associate daily activity totals with your account, without recording typed text, private files, visited URLs or individual clicks. The owner receives aggregate counts. Backups already made may retain earlier data until their rotation; see the retention section and contact us for privacy requests.
If you allow measurement, the last activity signal time is also stored to count currently active accounts without displaying their identities in the counter. Activity data expires within a 90-day window and is cleaned at startup and hourly while the service runs. Consent choice, version and date remain with the account to remember your preference.