Cookie Policy

1. What this policy covers

This policy explains how the websites and services operated by Cristobal Aranda under the Exylia name use cookies and similar technologies such as local storage. It applies to every site under exylia.net, including the hub (hub.exylia.net), the documentation (docs.exylia.net), Exylia Seller (www.exylia.net) and the panels of each service (for example analytics.exylia.net, staff.exylia.net or tickets.exylia.net).

A cookie is a small file a website stores in your browser; local storage is a similar space that stays on your device and is not sent with each request. The privacy policy of each service lists the exact cookies it needs to work. All of them are linked from https://hub.exylia.net/en/legal.

2. One choice for every Exylia site

The first time you visit an Exylia site, a banner asks whether you accept analytics cookies. Accept and Reject are equally easy, and nothing optional is loaded or stored until you choose: if you close the page without answering, no analytics runs.

Your answer is kept in the exylia_consent cookie (value granted or denied) on the .exylia.net domain for 180 days, so the same choice applies on every Exylia site and you are not asked again on each one. When it expires, the banner asks again. On an Exylia site served from another domain, the choice is stored for that domain only.

You can change your mind at any time with the "Cookies" or "Cookie settings" link in the footer of every Exylia site and app panel, which reopens the banner (see section 6).

3. The kinds of cookies we use

• Strictly necessary: they make a service work, for example keeping you signed in, protecting a sign-in against forgery or remembering your cookie choice. Without them the service cannot work, so they do not need your consent.
• Preferences: they remember choices you made, such as your language or theme. They are set when you make the choice and only serve to keep it.
• Analytics: Google Analytics and Microsoft Clarity, which show us how the sites are used. They are set only if you accept them (section 5).

We do not use advertising cookies, we do not build advertising profiles and we do not sell or share cookie data for advertising.

4. Necessary and preference cookies

Every Exylia site sets exylia_consent (strictly necessary, 180 days, described in section 2). Beyond that, each service sets only what it needs, which in general terms is:

• Session: a signed or encrypted cookie that keeps you signed in to a service's panel and identifies your session to its server. It lasts for the session or until you sign out, or for the period the service's privacy policy states.
• Sign-in state: short-lived cookies that protect a sign-in with Discord, Microsoft or another provider against forgery (CSRF and OAuth state) and remember where to return you. They last minutes and are deleted once you are signed in.
• Language: the language you chose, usually in the NEXT_LOCALE cookie (hub.exylia.net and the service panels, 1 year) or in local storage (exylia-docs-lang on docs.exylia.net, until you clear it).
• Theme and preferences: your light or dark theme, filters, collapsed menus or a dismissed announcement, in a cookie or in local storage, kept until you change them or clear your browser.

The exact names, purposes and lifetimes of each service's cookies are in that service's privacy policy, listed at https://hub.exylia.net/en/legal. The hub and the documentation set nothing beyond exylia_consent, NEXT_LOCALE and exylia-docs-lang, as their privacy policy at https://hub.exylia.net/en/legal/privacy explains.

5. Analytics cookies (only with your consent)

If you accept, the site you are on loads Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation). We use them to count visits, see which pages and features are used, find pages that fail or confuse people, and improve the sites. They set these cookies:

• _ga (Google Analytics): tells one browser apart from another to count unique visitors. 2 years.
• _ga_<id> (Google Analytics): keeps the state of the current visit. 2 years.
• _clck (Microsoft Clarity): keeps the Clarity identifier of the browser and its settings. 1 year.
• _clsk (Microsoft Clarity): joins the pages of one visit into a single recording. 1 day.
• CLID (Microsoft Clarity, set on Clarity's own domain): identifies the browser to Clarity across visits. 1 year.
• MUID (Microsoft, set on Microsoft's own domains): identifies the browser to Microsoft services, including Clarity. 1 year.

What they receive: the pages you visit (their address path and title), the page that linked to you, your device, browser and operating system, your screen size, an approximate location that Google and Microsoft derive from your IP address, and your clicks and scrolling. Clarity also builds session recordings and heatmaps of how pages are used (clicks, scrolling and mouse movement).

How they are configured: Google Analytics runs in consent mode with advertising storage, advertising user data and ad personalisation denied, and without Google Signals or any advertising feature. Clarity runs with advertising storage denied. Neither is used for advertising.

Masking: inside the app panels you reach after signing in, Clarity masks all text, so recordings show the layout and your clicks but not the content (names, messages, figures). Pages outside the panels that show personal data or customer content, such as public profiles, ticket transcripts or form answers, are masked the same way. Public pages such as the hub, the documentation, landing pages and legal texts are recorded unmasked because they contain no personal data. Page addresses and titles may include the name of a workspace, server or player; we use them only to measure and improve the services, never to advertise and never to sell.

Retention: Google Analytics keeps event data for 14 months (the period set in our account) and Clarity keeps recordings for 30 days. The cookies last as listed above unless you delete them or withdraw your consent.

Legal basis: your consent (GDPR art. 6.1.a and the ePrivacy rules on storing information in your device; in Chile, consent under Law 19.628 and Law 21.719). Google and Microsoft are in the United States and are certified under the EU-U.S. Data Privacy Framework. Their own policies apply to what they do as providers: https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement.

6. How to withdraw consent and control cookies

To withdraw your consent, use the "Cookies" or "Cookie settings" link in the footer of any Exylia site and choose Reject. The site deletes the analytics cookies it can reach (_ga, _ga_<id>, _clck and _clsk) and reloads the page so no analytics script stays running, and the choice applies to every Exylia site. Withdrawing does not affect the analytics already carried out with your consent. CLID and MUID live on Microsoft's own domains, which our sites cannot reach; you can delete them from your browser.

You can also see, block and delete cookies and local storage in your browser's settings. Blocking strictly necessary cookies will stop the services that need them from working (for example, you will not be able to sign in, and the banner will ask again on every visit). Blocking preference cookies only means your choices are not remembered. Google offers a browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout.

7. Content from third parties

Some services show content served by third parties, such as player heads from mc-heads.net, Discord avatars or payment pages of a payment provider. Loading that content lets the third party see your IP address and, if you go to its own pages (for example to pay with PayPal), it may set its own cookies there under its own policy. Apart from Google Analytics and Microsoft Clarity under your consent, no Exylia site loads third-party analytics or advertising tools.

8. Your rights, changes and contact

Personal data obtained through cookies is handled as described in this policy and in the privacy policy of the service that set them, which also explains your rights under Chilean Law 19.628, Law 21.719 and, if you are in the European Economic Area or the United Kingdom, the GDPR.

We will update this policy when our use of cookies changes and show the date of the latest version at the top. If we add a new kind of optional cookie, we will ask for your consent again. Questions: [email protected].