Cookies and Consent Policy

1. Scope and Definitions

Storage and access are broader than traditional cookies

Operator. MoyoTube is operated by MOYOTUBE TECHNOLOGIES LLC, a New Jersey domestic limited liability company. The main business address in the supplied formation certificate is 2110 E RT 70, Cherry Hill, NJ 08003, United States.

Cookies. Cookies are small records stored by a browser that can be returned to a website on later requests. They can support sign-in, security, saved choices or optional recognition. A cookie may contain an identifier rather than a person’s name; that does not automatically make its use anonymous.

Similar technologies. Local storage, session storage, SDKs, pixels, embedded-player storage, device identifiers and some fingerprinting or caching methods can involve similar storage, access or tracking. This policy covers them where used, even when a provider calls them “cookieless.” [CONFIRM actual technologies in the live service.] First and third party. A technology can be set by MoyoTube or a provider involved in a page, player, payment or integration. The actual domain, recipient and purpose matter. A first-party name does not prove that information stays with us; a third-party domain is not necessarily an advertising tracker.

Duration. A session cookie normally ends with the browser session; a persistent cookie has a set expiry. Server-side sessions or related records can have different lifetimes. Reissuing a cookie can change its expiry, so the retention of data and the lifetime of a browser identifier must be disclosed separately.

Information involved. Depending on the technology, identifiers, choices, browser details and interaction data can be involved. Necessary information handling is explained in the Privacy Policy. We do not represent every cookie as collecting every possible category.

2. Purposes and Categories

Classify the actual use, not just the label Necessary service functions

Authentication, requested access, essential security and other functions genuinely required to supply the service requested can qualify for an exception under applicable rules. They must not be repurposed for optional advertising or profiling under a necessary label. The precise technology, necessity and duration must be assessed.

Optional personalization

The supplied recommendation design uses an opt-in profile for category and creator interests. A recommendation cookie connects a browser to that profile. Users who do not choose it can receive the available country or global fallback discovery. Optional personalization must not be presented as essential to all viewing.

Analytics and improvement

Technologies used to measure service use must be identified and assessed. Our proposed default is to request consent for optional analytics unless a documented applicable exception is adopted. A narrow statistical exception in one jurisdiction does not authorize advertising attribution or individual profiling, nor automatically apply worldwide.

Advertising and marketing

If advertising pixels, cross-site recognition or attribution technologies are used, identify the purposes, providers, recipients and choices. [CONFIRM actual tools and statutory sale, sharing or targeted-advertising activity.] Receiving advertisements does not automatically require consenting to every behavioral tracking method.

Functional preferences and consent records

Technology that remembers a requested setting or your cookie choice must be assessed on its actual purpose. A record needed to honor refusal should not become an advertising identifier. [IDENTIFY the deployed consent-storage name, provider, scope and expiry; none is verified by this draft.]

3. Identified Cookie Details

Source-based register - verify before public adoption moyo_session - sign-in

Source name: moyo_session, configurable through SESSION_COOKIE_NAME.

Purpose: identify an authenticated session and support authorized account access.

Classification proposed: necessary when providing requested sign-in and protected access. Source expiry: based on SESSION_TTL_DAYS, default 30 days.

Source attributes: HTTP-only; Secure in production; SameSite=Lax; path “/”; no explicit Domain attribute in the inspected setter.

The token is linked to a server-side session record. Logout revokes the matching session and clears the cookie. Privileged-session and security rules can end authorization earlier than cookie expiry. [VERIFY live name, hostname, expiry and deployed behavior.]

moyo_interests - recommendations

Source name: moyo_interests.

Purpose: identify a consented recommendation profile.

Classification proposed: optional personalization, requiring the appropriate opt-in.

Source expiry: RECOMMENDATION_RETENTION_DAYS, default 180 days, issued when consent is saved.

Source attributes: signed profile identifier; HTTP-only; Secure in production; SameSite=Lax; path “/”; no explicit Domain attribute in the inspected setter.

Turning personalization off in the documented service clears this cookie and deletes the relevant profile and feed sessions. Signing in can associate a profile with an account following explicit consent. Clearing only the browser cookie is not necessarily a request to delete an account profile.

Not a complete inventory: [INSERT live domain/host, recipients, any other cookie names, storage keys, provider tools and purposes after audit.] Cookie attributes reduce some technical risks but do not themselves establish consent, anonymization or complete security.

4. Giving or Refusing Consent

A clear choice before optional technology

Prior choice. Where consent is required, non-exempt technology will not store or access information before a valid affirmative choice. Continuing to browse, scrolling, closing a banner, ignoring a prompt or accepting general Terms is not treated as consent to optional purposes.

Purpose-level choices. The proposed controls allow necessary functions and separate choices for optional personalization, analytics and advertising/marketing where those purposes actually exist. Optional choices should be off initially unless an applicable, properly documented non-consent exception is used. Do not show categories or providers that are not used.

Information before choice. Explain the operator, purposes, providers or recipients, duration and how to withdraw. Separate material disclosures from unrelated terms. A broad “improve your experience” label is not enough to explain advertising profiling.

Balanced controls. Provide an accessible way to accept optional purposes, reject them and make specific choices. The company proposes equally prominent accept and reject actions without preselected optional settings or misleading emphasis. Users should not face repeated pressure simply because they refuse.

No automatic inference. Necessary-cookie use does not imply consent to optional storage. A single multipurpose technology cannot rely on a necessary exemption for a separate non-exempt advertising purpose. Cookie consent and downstream personal-data processing require their own appropriate assessment.

Record of choice. Keep proportionate evidence of the choice, its purposes, version and time. [CONFIRM actual consent record and retention.] Retaining evidence is not a licence to create additional advertising history.

Working control - complete before adoption. [INSERT the verified Cookie Settings link or control.] This PDF does not activate a consent manager or block third-party scripts by itself.

5. Changing Your Choice

Withdrawal should be readily available

Reopen settings. Use the persistent Cookie Settings control once deployed to review or change optional purposes. Withdrawal should be as easy as giving consent. You should not need to open a new account, telephone a salesperson or accept marketing to decline tracking.

Effect of withdrawal. Stop the covered consent-based storage or access and associated processing, clear identifiers we can appropriately remove, and update providers or suppression controls as needed. Withdrawal does not make prior lawful processing unlawful. Necessary security or consent-proof records may remain for justified purposes.

Personalization design. Disabling personalization in the documented recommendation service deletes the relevant profile, events and feed sessions, clears the interests cookie, and sets marketing to false. Disabling only marketing leaves personalization available. [VERIFY deployed controls, deletion cascades and backup behavior.] Browser and account differences. Browser cookies apply to that browser; account choices can persist across sessions. Clearing a cookie can break anonymous-profile continuity but may not change a signed-in account preference. Explain the interaction and avoid automatically treating a signed-in session as consent to new optional purposes.

Fresh consent. Request it when purposes or recipients materially change or prior evidence is no longer appropriate. Refusal is not a reason to prompt on every page. [SET a justified consent/choice lifetime after assessing the actual service and jurisdictions; no universal legal expiry is asserted here.] Export and deletion. Recommendation export is a feature-specific tool. Broader access or erasure requests should use the Privacy Policy’s verified request route and include all relevant data, not only cookies. Clearing a cookie does not automatically erase financial, content or support records.

6. Browser Signals and Regions

Use the applicable rule for the actual processing

New Jersey and U.S. opt-outs. Where applicable state law covers our processing, recognized universal opt-out mechanisms such as Global Privacy Control must be honored for the covered purposes. Sale, sharing and targeted advertising are statutory concepts; relevant disclosures need not involve payment for data. [VERIFY applicability and implement signal handling before adopting a live claim.] California. If covered sale or sharing occurs under the CCPA/CPRA, supply the required opt-out links or compliant alternatives and honor applicable signals. Cookie rejection alone must not be represented as a complete statutory opt-out unless it actually stops all covered processing, including server-side disclosures.

EEA. Assess the relevant national implementation of ePrivacy rules alongside GDPR. Obtain required prior consent unless the specific purpose qualifies for an applicable exception. The fact that data is pseudonymous, aggregate or used by a U.S. company does not automatically remove device-storage rules.

United Kingdom. Updated PECR guidance recognizes purpose-specific exceptions, including restricted statistical or appearance uses subject to conditions and required information or objections. This draft does not automatically place all analytics in an exception. If an exception is adopted, document the exact activity and provide the required simple, free objection method.

Consent versus opt-out. A U.S. opt-out regime is not interchangeable with an EEA consent obligation. We must honor mandatory signals while obtaining consent where required; a banner cannot reduce stronger local protections. The proposed default is to avoid non-exempt optional activity until permission is recorded.

Do Not Track. Legacy DNT and GPC are different signals. [CONFIRM actual DNT response and disclose it accurately.] Do not claim support merely because another signal is recognized, or substitute DNT for mandatory GPC handling.

7. Players, Partners and Devices

Audit technology introduced through integrations

Embedded content. A player, social feature or external embed can introduce storage, requests or tracking before a user presses play. Where consent is needed, block the non-exempt activity or use an appropriate click-to-load explanation and choice. Do not silently launch optional advertising requests through a supposedly necessary player.

Payments and security. A checkout or fraud-protection provider can use information necessary for a requested transaction, but its independent marketing purposes require separate assessment. Identify actual provider roles and notices. [CONFIRM payment, identity and security integrations and what they access.] Creators and advertisers. User-uploaded links or campaign assets must not create unauthorized tracking through the platform. Approved integrations should follow the same consent and privacy controls. Creators do not receive viewers’ private cookie identifiers simply because their content is watched.

Other devices. Apps, mobile browsers, connected devices and SDKs can use identifiers outside a conventional cookie list. [ASSESS any actual native apps or connected-device services before describing them.] A web-only consent mechanism should not be claimed to cover a different app automatically.

Providers and transfers. Identify actual providers, recipients and countries in the inventory and Privacy Policy. Device consent does not itself establish a lawful international transfer mechanism. Third-party deletion, restrictions and retention must be confirmed by configuration and contract.

Children. The proposed Terms use an adult-only eligibility model. Actual access or data collection involving children still requires assessment. Avoid behavioral tracking based solely on an age statement; establish required protections when the actual audience or knowledge triggers them.

8. Browser Controls and Contact

Additional controls do not replace our obligations

Browser settings. Browsers commonly allow cookie deletion, blocking of some or all cookies, third-party-cookie restrictions and private browsing. Their names and behavior vary. Review your browser’s current settings. Blocking necessary sign-in cookies can prevent account or protected-access functions.

Limitations. Private browsing is not complete anonymity. It does not necessarily prevent server logging, account recognition, third-party requests or lawful transaction records. Browser cookie deletion is not the same as withdrawing an account preference or submitting a statutory erasure request.

Devices and shared access. Changes may apply only to the browser or device used. On a shared device, review the current choice. We must not assume that an earlier user’s consent represents every later user, or use fingerprinting to bypass deliberate cookie refusal.

Contact - complete before publication. [INSERT verified privacy email, working request form and persistent Cookie Settings link.] Company correspondence: MOYOTUBE TECHNOLOGIES LLC, 2110 E RT 70, Cherry Hill, NJ 08003, United States, subject to verification that the address accepts these enquiries.

Updates. Maintain the inventory as technology changes, date the adopted notice and provide necessary information and fresh consent before introducing a new non-exempt purpose. A revised policy alone does not authorize undisclosed tracking. Mandatory privacy and consumer rights are not waived by this notice.

Related notice. Read the Privacy Policy for information categories, recipients, legal bases, retention, transfers and rights. Neither notice should contradict the deployed controls or describe a feature as functioning when it is only planned.

End of proposed public policy. The following internal appendices are not part of the public notice. Resolve all bracketed fields and verify the inventory before adoption.