BAYTO COOKIES AND SIMILAR TECHNOLOGIES NOTICE
1. Scope
This Notice explains cookies, local browser storage, session identifiers and similar technologies used by the Bayto website, customer web booking form, Telegram Mini App, Web Admin and related web interfaces.
2. Categories
- Strictly necessary technologies support security, authentication, sessions, abuse prevention and requested functionality.
- Functional technologies remember optional interface settings such as theme, active organisation, navigation and queue state.
- Analytics and marketing technologies are not active in the current minimal scope and must not be enabled without updating this Notice and implementing an appropriate user choice where required.
3. Technologies used by Bayto
| Name/key | Storage | Category | Purpose | Duration | Provider |
|---|---|---|---|---|---|
| bayto_refresh_token | Host-only Bayto cookie | Strictly necessary | Secure auth refresh; Path=/api/auth; HttpOnly, Secure in deployed environments, SameSite=Lax | Up to 24 hours | Bayto |
| bayto_demo_browser_manager | Host-only Bayto cookie | Strictly necessary | Approved Demo manager access; HttpOnly/Secure/SameSite=Lax | Until demo session expiry | Bayto |
| bayto_demo_browser_client | Host-only Bayto cookie | Strictly necessary | Approved Demo client access; HttpOnly/Secure/SameSite=Lax | Until demo session expiry | Bayto |
| carwash_admin_access_token | sessionStorage | Strictly necessary | Short-lived Web Admin access token | Browser tab/session | Bayto |
| bayto_demo_access_token | sessionStorage | Strictly necessary | Short-lived Demo access | Browser tab/session | Bayto |
| bayto_landing_theme | localStorage | Functional | Landing light/dark theme | Until changed or cleared | Bayto |
| miniapp_theme | localStorage | Functional | Telegram Mini App theme | Until changed or cleared | Bayto |
| admin_theme | localStorage | Functional | Web Admin theme | Until changed or cleared | Bayto |
| carwash_app_mode | localStorage | Functional | Selected application mode | Until changed or cleared | Bayto |
| carwash_active_business_organization_id | localStorage | Necessary/functional | Restores active business context | Until changed, logout or clear | Bayto |
| carwash_business_admin_active_tab | localStorage | Functional | Restores the active Business Admin section | Until changed or cleared | Bayto |
| carwash_business_booking_queue_state | localStorage | Functional | Restores booking queue state | Until changed or cleared | Bayto |
| carwash_admin_auth_context | localStorage | Strictly necessary | Coordinates auth context between tabs without storing the refresh token | Until logout/context change | Bayto |
| bayto_admin_refresh_lease | localStorage | Strictly necessary | Short cross-tab refresh mutex | Approximately 30 seconds | Bayto |
| bayto_admin_refresh_request | localStorage | Strictly necessary | Coordinates refresh requests between tabs | No longer than 24 hours | Bayto |
4. User choice
Strictly necessary technologies cannot be disabled through a consent banner where they are required for security or a requested function. Users can clear or block browser storage, but this may sign them out or remove local settings.
If optional analytics, advertising, heatmaps, session replay, a payment provider or another SDK is added, Bayto must update the register and introduce an appropriate choice before activation.
5. Telegram context
Telegram may use its own technologies under its own terms when Bayto is opened as a Mini App. Bayto does not control the Telegram client. Telegram identity used by Bayto must be based on backend verification of initData.
6. Contact
Questions about cookies and privacy: support.bayto.io@gmail.com.