Cookie Policy

Version v1_2026-05-15 · Last updated 15 May 2026

This page describes the cookies and similar local-storage technologies that Panda uses, and your choices around them. It supplements our Privacy Policy. Kenya's Data Protection Act 2019 treats cookie identifiers as personal data; we list every cookie we set so you can decide whether to allow them.

Strictly necessary

These are required for the site to function. They cannot be switched off:

• XSRF-TOKEN / panda_session — set by the Laravel API on form-submit pages (the contact form on this site). Anti-CSRF protection. Session-scoped.
• __cf_bm — set by Cloudflare to distinguish humans from bots. 30 minutes.
• cf_clearance — set by Cloudflare after passing a security challenge. Up to 30 days.

App authentication (not cookies)

The Panda PWA at app.panda.shira.farm stores your authentication token in browser localStorage, not in a cookie. localStorage is similar technology and is covered by this Policy. The token is cleared on logout or when it expires.

Analytics (planned, not yet active)

Panda does not currently use any third-party analytics provider. When we add analytics, we will use a privacy-friendly, cookie-less provider (e.g. Plausible) and update this Policy accordingly. If we ever switch to a provider that requires consent under DPA 2019, we will display a consent banner before any tracking cookie is set.

Marketing

Panda does not use marketing or advertising cookies.

Managing cookies

You can clear or block cookies through your browser settings. Doing so may break the contact form or trigger additional Cloudflare security challenges. Clearing localStorage will log you out of the PWA.

Contact

• Questions: dpo@shira.farm