1. What cookies and browser storage are
Cookies are small values stored by the browser and sent with matching web requests. Local storage and session storage are browser-side storage mechanisms that are not sent automatically with every request, but can still contain identifiers or preferences.
2. Storage used by this site
| Name | Type | Purpose | Lifetime | Category |
|---|---|---|---|---|
| locale | Cookie | Remembers a language selected by the visitor. | Up to 1 year | Preference / requested functionality |
| necrotix_traffic_session | HTTP-only session cookie | Random first-party session identifier used to estimate visits, live traffic and retained public-page activity. The server stores only a one-way hash of the cookie value with analytics records. | Browser session; live session record about 24 hours; page activity up to about 30 days | First-party measurement |
| necrotix_blog_like_id | Cookie | Pseudonymous identifier created when Blog Like functionality is used, so the site can remember and toggle that interaction. | Up to 2 years | Functional interaction |
| necrotix_gallery_like_id | Cookie | Pseudonymous identifier created when Gallery Like functionality is used. | Up to 2 years | Functional interaction |
| portfolio-private-access | Cookie | Temporary access token when the site owner enables Private mode and a visitor successfully enters the access password. | About 12 hours | Strictly necessary |
| Authentication / admin session | Cookie | Keeps authorised administrators signed in and protects the administration area. | Session / configured auth lifetime | Strictly necessary |
| sidebar_state | Cookie | Remembers the administration sidebar state. | Up to 7 days | Admin preference |
| portfolioLoaded | Session storage | Prevents the first-visit Niko intro from repeating during the same browser session. | Browser session | Presentation preference |
| necrotix:blog-view:* | Session storage | Prevents duplicate Blog view-count requests in the same browser session. | Browser session | Aggregate engagement |
| necrotix:gallery-view:* | Session storage | Prevents duplicate Gallery view-count requests in the same browser session. | Browser session | Aggregate engagement |
| portfolio-chat-messages-v2 | Session storage | Keeps the visible AI assistant conversation in the current browser tab/session. | Browser session | Requested chat functionality |
| portfolio-theme | Local storage | Remembers the selected visual theme where supported. | Until changed or cleared | Preference |
3. First-party functional and measurement storage
Storage used for requested functionality includes language, theme, authentication, private-site access, Likes and session-level view markers. These entries are separate from advertising and cross-site behavioural tracking.
Homepage A/B testing has been retired. No new experiment cookies or events are created. Cookies from an earlier version expire with the browser session.
Short-retention traffic analytics uses a separate random HTTP-only session cookie. Its random value is hashed server-side before it is associated with analytics records. A visit is counted again after about 30 minutes of inactivity. Real public-page navigation can be retained as a page-activity row containing the public pathname, country code, coarse city where available, broad device class and the hashed traffic-session reference. Query strings and URL fragments are removed before storage.
Country and city headers supplied by hosting/CDN infrastructure are preferred. When a public client IP address is available, the server can send it to ipwho.is for short-lived country, city and network-provider context. Raw IP, ASN, ISP, organisation and network-domain details are shown only in recent administration analytics and are cleared from page-activity records after about 24 hours. Latitude, longitude and other precise coordinates returned by a provider are not stored. The page path, country, city and broad device class can remain for up to about 30 days. Retention cleanup is checked every six hours and runs on the next page-view request.
When a browser sends the Do Not Track signal, the public page-view tracker does not submit traffic analytics events.
The current application code does not intentionally set first-party advertising or cross-site behavioural advertising cookies.
4. External media and third parties
Some Gallery works can embed media from YouTube, Vimeo, TikTok, Instagram, Facebook, X/Twitter, Pinterest or Dailymotion. When an external player is loaded, your browser connects directly to that provider. The provider may receive your IP address, browser information and may use its own cookies or browser storage under its privacy and cookie rules.
External-provider storage is not controlled by NecrotixLab. If you do not want a provider to receive a direct request, do not load or interact with its embedded media and use the provider's privacy controls where available.
5. Managing storage
You can delete cookies, local storage and session storage through your browser settings. Deleting functional or measurement storage can reset language, theme, Like state, view-session markers, traffic-session state, chat history or private-access state.
Blocking all cookies may prevent authentication, Private mode and some interactive or measurement features from working correctly.
6. Personal data and your rights
A cookie ID, IP address or similar online identifier can be personal data when it can relate to an identifiable person. For more information about purposes, legal bases, retention, recipients and your rights, read the Privacy & GDPR Policy.