Cookie Policy in plain English
Last updated: 19 June 2026
This page is a short summary. It is here so you can understand what cookies we set, in plain words. It does not replace the formal Cookie Policy, which is the binding legal text.
What is a cookie?
A cookie is a small file a website saves in your browser. Websites read it back on your next visit. Some cookies remember settings like your language. Some keep you signed in. Others help a site load safely, and a few are used to track what you do across the web. It is that last kind that people usually worry about.
We do not set tracking cookies. We do not run Google Analytics, advertising pixels, or anything that follows you around the internet. None of it.
The cookies we set
Maelstrom AI runs two platforms under one set of rules: Provii, our zero knowledge age verification service, and downpipes, our no-custody backup and disaster recovery for the Cloudflare data layer. The cookie posture is the same for both. Our own code sets no cookies, and the only cookies you might see come from Cloudflare keeping the sites safe, plus one small cookie that remembers your cookie choice.
There are a few places where cookies might appear. One is our main websites. One is our developer docs site. The downpipes operator console is a special case, and we explain it below.
On our main websites
This covers our corporate website (maelstrom.au), the Provii website, and the downpipes website (downpipes.io). Our own code sets no cookies at all. None. The sites run on Cloudflare. Cloudflare may set a small number of cookies to keep them safe from bots and attacks.
These are the Cloudflare cookies you might see:
__cf_bm: this helps Cloudflare tell humans apart from bots. It lasts 30 minutes.cf_clearance: this is set if you solve a security challenge. It lasts up to 24 hours.__cflb: this keeps you talking to the same server during a visit. It lasts for the session only.
None of these cookies know who you are. None of them follow you across other websites. They exist so the sites load safely.
We also set one small cookie called cookie_consent to remember your cookie choice. It lasts one year. It holds nothing but your preference.
On our developer docs site
If you visit docs.provii.app and use the interactive sandbox, we set one cookie called __Host-docs_session. It holds a random ID for your sandbox session. Nothing else. No name, no email, no account link.
It lasts 15 minutes of active use, and no more than 4 hours in total. After that, it is replaced.
The downpipes operator console
The downpipes console (console.downpipes.io) is run inside the customer’s own Cloudflare account, under the customer’s own keys. It is not a service we host for you, so any cookies it sets are set in the customer’s own tenant, not by us. The update channel for the downpipes engine (updates.downpipes.io) is just a static file store. It has no login and no session, so it sets no cookies at all.
Why we do not show a cookie banner
Australian law and the EU ePrivacy rules both allow one thing without consent. Cookies that are strictly needed to run a service you asked for. Bot protection is one example. A sandbox session for developers is another. Remembering a cookie choice you already made is a third. Keeping a site online through a load balancer is a fourth. So we do not nag you with a banner for these.
If we ever add analytics cookies in future, we will ask you first. We are not using any today.
How long cookies last
The shortest one lasts 30 minutes. The longest one lasts one year. Most are gone within a few hours or when you close the tab.
If you close your browser or clear site data for our domain, the cookies go with it.
How to clear cookies in your browser
Every browser has a “clear cookies” setting. Here is where to find it on the four most common ones:
- Chrome: Settings, then Privacy and security, then Cookies and other site data.
- Safari: Preferences, then Privacy, then Manage Website Data.
- Firefox: Settings, then Privacy & Security, then Cookies and Site Data.
- Edge: Settings, then Cookies and site permissions, then Manage and delete cookies.
You can clear cookies for every site, or just for ours. You can also block cookies by default. Our main sites will still load fine. The developer sandbox may ask you to start a new session if the session cookie is missing.
On a phone, the same settings live inside the browser app, usually under “Settings” and then “Privacy”. If you use a private or incognito window, cookies are cleared on their own when you close the window.
Read the full legal text
The formal, binding version is at Cookie Policy. It covers the same ground in legal language. It has the full table of cookies and the legal basis we rely on.
If you have a question about cookies on our sites, email us at privacy@maelstrom.au.