Cookie Policy
CARVEOO | Version 1.0
Effective date: 2026-10-22
Approval: Approved by the Carveoo owner.
This policy describes technical storage used by the reviewed Carveoo implementation. A technical cookie lifetime is not a retention promise for related database records or backups. It does not assert unconfirmed third-party processing arrangements or a compliance certification.
1. How storage supports the marketplace
Cookies are small browser values sent with relevant requests. Session storage retains values for a browser tab/session; it differs from cookies and longer-lived local storage. Carveoo uses storage to support authentication, cart/session continuity, chosen language/currency and trip selections. Storage does not intentionally check a terms checkbox or replace server-side consent enforcement.
2. Account and security cookies
WordPress authentication cookie families such as wordpress_logged_in_* and wordpress_sec_* identify a signed-in session. wordpress_test_cookie supports a login cookie check; wp-settings-* and wp-settings-time-* can store account/editor preferences. Whether these appear and their expiration depend on the login route, session and WordPress settings, including any remember-login choice. This policy does not claim one universal login lifetime or expose cookie values.
carveoo_account_continue is an opaque booking-continuation cookie used when returning from account login/email verification. The reviewed code sets a one-day expiry, Secure, HttpOnly and SameSite=Lax, with a corresponding one-day server transient for the validated same-site booking destination. It is not a password or legal-acceptance receipt.
3. Cart and checkout session storage
WooCommerce uses the wp_woocommerce_session_* cookie family to associate a browser with server-side session/cart data. woocommerce_cart_hash and woocommerce_items_in_cart support cart updates when that native cart functionality is used. These are conditional on the journey and WooCommerce behavior; this review did not create a booking or order to force a fresh checkout session or measure every deployed cookie expiry. Server-side sessions and order records have separate lifecycles.
4. Language and currency preferences
cv_ui_language stores the selected Carveoo interface language. cv_display_currency stores USD or EUR for displayed prices. Each is set with a 31,536,000-second maximum age (approximately one year), sitewide path and SameSite=Lax; Secure is added on HTTPS. The selections are independent. EUR display uses the configured conversion reference; USD remains the authoritative order/checkout currency. A preference cookie is not a payment authorization.
The installed FOX currency component may also maintain native preference/session data depending on its storage configuration. No unverified name or lifetime is assigned here to an additional FOX cookie.
5. Trip and booking information in session storage
carveoo_marketplace_trip_range_v1 retains selected rental dates and a saved timestamp. The reviewed listing code rejects records older than 30 minutes. Booking bridge code uses session-storage keys beginning carveoo_booking_state_ and related selection/continuity keys to retain booking form and pricing-display context within the tab. These values do not override a server quote or make consent valid. Session storage normally lasts for the browser tab/session; browser restoration can affect that lifecycle. No blanket database-deletion deadline follows from clearing it.
6. Maps, fonts and tracking
The inspected public pages include Mapbox mapping/geocoder resources from api.mapbox.com and Google Fonts styles from fonts.googleapis.com. Loading external resources discloses request/connection information to those providers and can involve their own browser storage or subsequent font/map requests. A complete third-party cookie inventory and provider retention were not independently verified. These resources were present in the page without an observed cookie-choice dialog; this policy does not claim that a consent-management system blocks them.
The inspected homepage and vehicle-page script URLs did not identify Google Analytics, Google Tag Manager, Meta Pixel or Hotjar. HivePress and WooCommerce usage tracking are currently off. These observations do not certify the absence of all tracking on every route, hosting layer or future integration. WPForms Lite is installed, but its entry backups are off and the reviewed Contact page uses native booking messaging. No unverified WPForms tracking cookie is listed as a confirmed active cookie here.
7. Managing storage
You can use your browser controls to inspect, block or clear cookies and site storage. Doing so may sign you out or remove retained dates, cart information, language or currency preferences. Use the Carveoo language/currency dialog to change those preferences. This page provides information and does not introduce a new consent banner or declare that a particular consent choice has already been made.
8. Further information and updates
Use the Help Center for questions about Mapbox and Google resources, additional analytics or marketing, service-provider arrangements and available storage controls. This page does not claim that a cookie-choice system blocks these resources, certify legal compliance, or assign unverified conditional cookie lifetimes. Changes to resources, storage or controls require the published description to be reviewed; this page does not automatically select or record a consent choice.
Related policies: Host Terms · Host Policies · Guest Terms · Cancellation & Refund · Insurance & Damage · Roadside Assistance · Major Disruptive Events · Privacy · Cookies.