Cookie Policy
Last updated: September 2026
1. What Are Cookies
A cookie is a small piece of text a site asks your browser to store and to send back with later requests. A cookie is not the only thing a site can keep on your device, and the difference matters: section 4 lists what this site keeps in your browser’s local storage instead, which is not a cookie, is never attached to a request, and never reaches us.
2. Cookies We Set
All five are first-party, set by caio.ltd itself. None of them is used for advertising, for building a profile of you, or for following you to another site.
| Cookie | Set when | What it does | Lifetime | Strictly necessary |
|---|---|---|---|---|
__Host-authjs.csrf-token | On the first page you open, whether or not you ever sign in | A cross-site request forgery token. It is how a form you submitted is told apart from one another site submitted in your name. | Until you close your browser | Yes |
__Secure-authjs.callback-url | In the same request as the one above | Remembers which page to return you to after you sign in. | Until you close your browser | Yes |
__Secure-authjs.session-token | When you sign in | Your signed-in session. It carries your account id and role, signed by us so it cannot be edited or forged. | 30 days, renewed each time the session is checked | Yes |
__Secure-authjs.pkce.code_verifier | Only while a Google or Facebook sign-in is actually in progress | Half of the PKCE proof that ties the code the provider hands back to the sign-in you started, so somebody else's code cannot be substituted for yours. | 15 minutes | Yes, for that sign-in |
locale | Only if you use the language switcher in the footer | Stores your choice — English or हिन्दी — so pages render in it. It holds nothing else and identifies nobody. | 1 year | No. A preference, written only when you pick one |
The first two arrive even if you never sign in, and they do not come with the page itself: every page loads a small script that asks the site whether you are signed in, and that request is what sets them. So a reader who only browses does end up holding two cookies, both of which exist to make signing in safe.
Names beginning __Host- and __Secure- are not decoration. They are instructions to your browser to refuse the cookie unless it came over HTTPS from this exact host, which is what stops one being planted by anybody else. All of them are also HttpOnly, so no script on the page can read them — the one exception is locale, because the language switcher in your browser is the thing that writes it.
3. Analytics
We use Cloudflare Web Analytics, which measures page views without cookies and without storing any identifier for you. There is nothing to consent to and nothing to opt out of, which is why this site no longer shows a cookie banner. We removed Google Analytics on 2 September 2026.
4. What We Keep In Your Browser That Is Not A Cookie
These live in your browser’s local storage. They are never sent to our servers, they are not attached to any request, and clearing your site data removes them.
| Stored under | What it holds |
|---|---|
selected-city, user-location | The city you picked in the city selector, so the site does not ask again on the next page. |
geo-dismissed | Records that you closed the offer to detect your location, so it stops asking. |
caio.pwa-install-dismissed | Records that you dismissed the prompt to install this site as an app. |
Earlier versions of this page listed user-location as a cookie. It never was one, and it is named here rather than quietly dropped so that anyone who read the old page can see what changed.
5. Third-Party Cookies
caio.ltd sets no third-party cookie of its own. If you choose to sign in with Google or Facebook, or to pay through Cashfree or PayPal, you are handed to those companies and they set their own cookies on their own domains. Those are governed by their privacy policies, not by this one, and we cannot state their lifetimes here because we do not set them.
6. Managing Cookies
Your browser settings can delete or block cookies, and clear local storage with them. Blocking ours will break signing in specifically: without the CSRF cookie the sign-in form is refused, and without the session cookie you are signed out again on the next page. Browsing, searching and reading listings do not need any of them.
7. Contact
For questions about our cookie usage, contact support@caio.ltd. How the underlying protections work is described on selling without giving out your phone number.