Cookie policy
Updated: September 12, 2026 · Version 1.0
This policy explains which cookies and similar technologies the Avatar website and application (the "Platform") use, what they are for and how you can manage your choice. It applies together with the Privacy Policy.
1. What cookies are
Cookies are small text files a website stores in your browser. They let the site recognise your browser on the next visit, keep you signed in and remember settings. Some cookies are set by us (first-party); some by third-party analytics services, if you have consented to them.
2. Cookie categories
Necessary. Required for the Platform to work: signing in, protection against request forgery, the selected language and the record of your cookie choice. Always set, no consent required; they cannot be disabled without breaking the service.
Analytics. Anonymised visit statistics: which pages are opened, from which devices, for how long. They help us improve the site. Set only after your consent.
Marketing. Ad network pixels for campaign measurement. Not in use at the moment; when connected they will run only with consent.
3. Technical cookies
| Name | Category | Purpose | Lifetime | Attributes |
|---|---|---|---|---|
refresh | Necessary | Session refresh token. Stored server-side only as a hash, rotated on every use | 30 days | httpOnly; Secure; SameSite=Lax; Path=/api/v1/auth |
has_session | Necessary | Marker that a session exists, used for routing in the app. Contains no secret | 30 days | Secure; SameSite=Lax; Path=/ |
csrf | Necessary | Cross-site request forgery protection | session | Secure; SameSite=Strict |
locale | Necessary | Selected interface language | 1 year | SameSite=Lax |
cookie_consent | Necessary | Your choice per cookie category as JSON, e.g. {"necessary":true,"analytics":false,"marketing":false,"v":1} | 365 days | SameSite=Lax, shared across subdomains |
The API access token is never stored in a cookie — it lives only in the memory of the browser tab and is cleared when the tab closes.
4. Analytics cookies (with consent)
| Service | Cookies | Lifetime | More |
|---|---|---|---|
| Google Analytics 4 | _ga, _ga_* | up to 2 years | policies.google.com/technologies/cookies |
| Yandex Metrika | _ym_uid, _ym_d, _ym_isad | up to 1 year | yandex.com/support/metrica/general/cookie-usage.html |
Scripts for these services are not loaded until you choose "Accept all" or enable the "Analytics" category in settings. IP addresses in Google Analytics are anonymised.
5. Managing your consent
On your first visit a banner offers "Accept all", "Necessary only" and "Customise". You can change your choice at any time via the "Cookie settings" link in the site footer. You may also delete cookies in your browser; the banner will then appear again.
For visitors from the European Economic Area, cookies are processed in line with the GDPR and the ePrivacy Directive: non-essential cookies are set only after explicit consent. For visitors from the Russian Federation, processing follows Federal Law No. 152-FZ "On Personal Data".
6. Changes to this policy
For material changes we update the policy version and ask for consent again. The date of the last update is shown at the top of the page.
7. Contact
For data processing questions, use the personal data email address listed on the Contact page.