Cookie Policy
This page lists everything Avahit stores in your browser. It is deliberately exhaustive: under the ePrivacy Directive anything stored on your device needs either your consent or a strict necessity, and the only way to show which is which is to name them one by one.
What Avahit itself sets
Four cookies, all strictly necessary for signing in, all set by our own domain, none used for advertising or analytics. They exist only after you log in — browsing anonymously sets no cookie at all.
| Name | Purpose | Lifetime |
|---|---|---|
authjs.session-token | Keeps you signed in between page loads. | 30 days, or until you log out |
authjs.csrf-token | Blocks cross-site request forgery on the sign-in and sign-up forms. | Session |
authjs.callback-url | Returns you to the page you came from after signing in. | Session |
__Secure- variants | The same three cookies under their HTTPS-only names, which is what your browser actually receives on avahit.com. | As above |
These are exempt from consent because the service cannot work without them: without a session cookie there is no way to stay logged in, and without a CSRF token the login form is unsafe. You can still block them in your browser; you will simply be unable to sign in.
Local storage, not cookies
Two keys live in your browser’s local storage and never travel to our server:
avh_consent— your answer to the cookie banner. Storing it is what stops us asking again on every page. Clearing site data resets your choice.- A record of when you last visited, used to mark posts as new since your last visit.
Cookies set by creators on their storefronts
This is the part that requires your consent, and the reason you see a banner. A creator can connect their own Meta Pixel or Google Analytics 4 property to their profile and product pages, the way LTK and ShopMy storefronts work. When that happens:
- the scripts belong to Meta and Google and set their own cookies (
_fbp,_fbc,_ga,_ga_*) under their own policies, not ours; - they load only after you press Accept;
- pressing Decline, or ignoring the banner, means no pixel runs anywhere on Avahit — there is no “legitimate interest” fallback and no delayed loading;
- they appear only on the pages of creators who configured them, not across the site.
We do not receive the data those pixels collect. Meta’s and Google’s handling is governed by their own terms, which you can review at the links they publish.
What we do not set
- No analytics of our own. We do not run a page-view tracker, and we do not build a profile of what you browse.
- No advertising or retargeting cookies belonging to Avahit.
- No third-party fonts. Typefaces are served from our own server, so no request reaches Google Fonts.
- No social embed cookies. Product images are copied to our storage rather than hot-linked, so viewing a post does not call the merchant.
Affiliate measurement cookies
This is its own category on the banner, not a footnote inside “analytics”. When you tap a product, the store and its affiliate network set a cookie on their domains so that a purchase is credited to the creator who posted it. That cookie is not strictly necessary for Avahit to work, so under the ePrivacy Directive it needs your consent, and it is gated by the banner along with everything else optional.
The networks that may be involved, each under its own policy:
We are not a party to those programmes — the creator is. What each network stores, for how long, and how to opt out of its tracking is set out in the policies above.
Proving what you chose
Every Accept and Decline is recorded on our server with the date, the version of the banner text you saw, and the categories it offered. No name, no email, and the same one-way IP hash we use for clicks rather than the address itself.
The reason is practical: an affiliate network may ask us to demonstrate that consent was collected before its cookie was set, and a decision living only in your browser cannot demonstrate anything. Keeping the banner version is what makes the record meaningful — it answers not just when you chose, but what you were choosing between.
Clicking a product link
Outbound links pass through /go/ on our domain, which records the click and forwards you to the store. That step writes no cookie on your device. What it does record — a one-way hash of your IP address, kept for 90 days — is explained in the Privacy Policy.
The store you land on will set its own cookies, including the affiliate network’s tracking cookie that attributes the sale to the creator. That happens on the merchant’s domain under the merchant’s policy, and it is the mechanism by which creators are paid at all. Our affiliate disclosure explains the money side.
Changing your mind
Clear the site data for avahit.com in your browser and the banner returns with a fresh choice. Browser-level controls — blocking third-party cookies, or a Global Privacy Control signal — are respected: with third-party cookies blocked, creator pixels cannot function regardless of what you pressed.
Questions
Write to [email protected]. If you want the full picture of what we hold and why, read the Privacy Policy; if you want to know which companies process data on our behalf, see subprocessors.