How IndoPac uses cookies, browser storage, and similar technology.
IndoPac does not use non-essential cookies for targeted advertising, cross-site profiling, or social plug-ins.
The public site uses Google Analytics 4 only for audience measurement. IndoPac does not combine it with ad tech, retargeting, Google signals, or cross-site profiling. Readers can turn measurement off under Analytics settings in the footer.
Amazon Cognito's managed sign-in pages may use strictly necessary cookies or similar storage to authenticate a reader, protect the sign-in flow, and manage a Cognito session. Those controls are operational, not advertising technology.
After a successful sign-in, IndoPac keeps account access, identity, and refresh tokens in sessionStorage for that browser tab or window rather than in localStorage. The tokens authorize account API requests and can contain an account identifier or email claim. They are removed when the session is cleared or the reader signs out; the Cognito sign-in service may maintain its own necessary session until it expires or is ended.
A short-lived PKCE verifier and sign-in state value may also be held in sessionStorage while a reader moves through the authentication callback. They help prevent an intercepted authorization code or unrelated request from being accepted.
Browsers, hosting systems, and CDN layers may use caching, TLS sessions, anti-abuse controls, and similar functions to deliver content and keep the site available. IndoPac treats these as operational tools, not profiling or marketing tools.
Browser storage remembers a reader's analytics choice and saved-story identifiers. Unless an account feature explicitly says it will sync a setting, saved stories stay on that device and are not a cross-device profile.
Profile images remain in private object storage. Time-limited signed upload or viewing requests contain authorization information in the URL or form fields; they are access credentials, not cookies, and expire automatically.
Where runtime configuration enables it, a weekly update includes an interactive map provided by Google Maps. The map begins loading when the weekly page loads; the article, map headlines, and ordinary story links remain readable if the third-party map is blocked or unavailable.
Loading the map causes the browser to request Google Maps resources directly. Those requests can disclose the reader's IP address, device and browser information, and the referring page or site origin to Google, which handles that information under the Google Maps Platform Terms of Service and Google Privacy Policy.
Google Maps may use cookies or similar technologies under Google's own terms and privacy policy after its resources are loaded. The interactive map is not required to read the weekly update or open its story links.
Google-supplied logos, copyright notices, and map or data-provider attribution must remain visible and must not be removed, altered, hidden, or obscured.
A source publisher may use its own cookies or tracking when a reader leaves IndoPac. IndoPac does not control those practices. Review the destination site's privacy and cookie notices for details.
Readers can turn analytics off in the footer, and IndoPac honors Global Privacy Control for analytics. Signing out clears the tokens held for the active IndoPac tab or window and asks Cognito to revoke the refresh token; readers should also close shared-browser sessions and avoid sharing signed file links.
Before adding more analytics, third-party media, ad tech, or other non-essential tracking, IndoPac will update this page and review its legal basis and reader controls.