Cookie Policy
Last updated: August 2026 — Version: 1.0
1. What Cookies Are
Cookies are small text files that a website stores on your device. Some are indispensable for a site to function at all (keeping you logged in, protecting forms against forgery); others serve measurement or advertising purposes and are optional. This page explains exactly which cookies Jokaya uses, why, and for how long. It supplements our Privacy Policy.
2. Our Approach: Essential First, Nothing Else Without Consent
Our design principle is simple:
- No non-essential cookie is set before you consent. When you first visit Jokaya, only strictly necessary cookies are placed. Any optional cookie (for example, analytics measurement) is set only after you click "Accept" in the consent banner.
- Refusing is as easy as accepting. The banner shows "Accept" and "Refuse" buttons with equal prominence — one click each. Refusing never blocks you from using the service.
- You can change your mind at any time via the "Cookie settings" link in the footer, which reopens the banner. Withdrawing consent removes the optional cookies going forward.
3. Cookies We Use
The table below lists each cookie currently set by Jokaya. All of them are first-party and classified as strictly necessary, so they do not require consent under the GDPR and the ePrivacy rules; we list them for transparency.
| Cookie name | Purpose | Duration | Category |
|---|---|---|---|
| session | Authentication session — keeps you logged in as you navigate between pages, and expires when the session ends or you log out. | Session (deleted when the browser closes) or up to 30 days if you choose "Remember me" | Strictly necessary |
| csrf_token | Security token that protects forms and account actions against cross-site request forgery (an attack where another site tries to submit actions as you). | Session | Strictly necessary |
| cookie_consent | Records the choice you made in the consent banner (accepted or refused, with the date and the policy version), so we do not ask again on every page. | 6 months | Strictly necessary |
If you consent to analytics measurement in the banner, our analytics tool may set its own measurement cookies at that point; the banner's details panel lists their exact names and durations before you decide. If you refuse, they are simply never set.
4. What We Deliberately Do Not Do
- We do not set advertising or cross-site tracking cookies on Jokaya.
- We do not load third-party social media widgets that would set their own cookies on our pages.
- We do not use consent walls: refusing cookies does not degrade your access to offers or rewards.
Note that when you leave Jokaya by clicking through to an advertiser's website, that site has its own cookie practices, which we do not control. Attribution of your offer completion relies primarily on click identifiers passed in the link, not on cookies we set.
5. Legal Basis and How Consent Works Here
Under the GDPR and the French Data Protection Act as interpreted by the CNIL, strictly necessary cookies may be set without consent because the service you asked for cannot work without them; every other cookie requires your prior, informed, freely given consent. Our banner is built around those requirements:
- Informed: before choosing, you can open the details panel and see every optional cookie's name, purpose, provider, and lifetime.
- Prior: optional cookies are technically not loaded until the moment you click "Accept". This is enforced in code, not just promised in text — the analytics script is simply never requested for visitors who have not consented.
- Freely given: "Refuse" is on the first screen of the banner, styled with the same prominence as "Accept". There is no "legitimate interest" pre-ticked toggle, no maze of sub-menus, and no nagging: after you decide, the banner stays away, and we re-ask at most when your consent record expires (6 months) or when we introduce a new cookie category that needs consent.
- Revocable: the footer link "Cookie settings" reopens the banner at any time, and withdrawing consent is one click — exactly as many as giving it.
Your consent choice itself (date, decision, banner version) is stored in the cookie_consent cookie and in our records, because the GDPR requires us to be able to demonstrate consent. That record contains your choice, not your browsing history.
6. Similar Technologies (Local Storage and Tracking Pixels)
The rules on this page apply to all storage and tracking technologies, not just cookies in the narrow technical sense:
- Local storage / session storage: we may use browser storage for interface preferences (for example, a collapsed menu state). Nothing stored there identifies you to third parties or is used for tracking, and it never leaves your browser.
- Tracking pixels and web beacons: we do not embed third-party tracking pixels in the site or in our transactional emails.
- Offer click identifiers: when you click an offer, attribution relies on identifiers passed in the outbound link to the advertiser network rather than on cookies we set. What data accompanies those clicks, and how California residents can opt out of this transmission, is described in Sections 4 and 10 of the Privacy Policy.
7. Managing Cookies in Your Browser
Beyond our banner, every major browser lets you view, block, and delete cookies in its settings (usually under "Privacy" or "Site data"). Two practical warnings for a rewards site:
- Deleting the session cookie logs you out.
- Aggressive cookie-blocking extensions or "total blocking" modes can break offer tracking on advertiser sites, which is one of the most common reasons an offer completion fails to credit. If you use them, consider allowing the advertiser's domain for the duration of the offer.
8. Changes and Contact
If we add, remove, or change a cookie, we will update the table above and, where the change requires consent, the banner will ask you again. Questions about this policy or about a specific cookie you see set by our domain: contact@canopia.cloud. If you believe a cookie is being set in violation of this policy, tell us — that would be a bug we want fixed, and you can also lodge a complaint with the CNIL (www.cnil.fr).