Policy · Updated 12 February 2026

Cookies policy

1. What cookies are

Cookies are small files or browser storage entries that help a website remember a setting or understand a visit. Plume uses them sparingly and explains their purpose here.

The term covers several technologies: cookies set through the browser, local storage entries, and similar identifiers. Some are strictly needed to deliver a page or to remember a choice, while others measure use and are optional. Plume groups the entries it uses into three categories, essential, preference, and analytics, so that readers can see which ones depend on consent. This page applies to every page of the site and is read together with the Privacy policy.

A cookie is a text entry saved by the browser at the request of a website, while local storage is a separate area of the browser where a site can keep small pieces of information. Both stay on the reader’s device and can be removed by the reader. Plume does not use fingerprinting techniques, which identify a device by its configuration without storing anything on it.

(a) Essential: needed to deliver a page securely.
(b) Preference: remembers a choice, such as the banner answer.
(c) Analytics: measures use and is set only after consent.

2. Essential operation

Hosting infrastructure may use temporary session identifiers to deliver pages securely. These normally expire when a browsing session ends and are not used to build advertising profiles.

If the hosting environment issues a session identifier, it is commonly named PHPSESSID or similar, contains a random value with no personal details, and is deleted when the browser is closed. It supports routine operations such as keeping a form submission within one visit and protecting the site from automated abuse. Because these entries are needed to deliver the service a reader has requested, they do not depend on the banner choice. Plume does not read the contents of a session identifier to learn anything about a reader.

Security measures that work at the network level, such as rate limiting, may record the time and the address of repeated requests for a short period. These records are used to keep the contact form from being flooded and are not combined with analytics information. Plume does not treat a session entry as a reason to ask for consent, but it describes it here so that a reader knows it exists.

(a) Name: PHPSESSID or a similar session name, where issued by the hosting environment.
(b) Lifespan: until the browser is closed.
(c) Type: first-party, essential.
(d) Contents: a random value without personal details.

3. Consent preference

The site stores cookieChoice when you select Accept or Reject in the banner. This preference remains until browser storage is cleared or a new choice is recorded, usually for up to 13 months.

The cookieChoice entry records whether the reader selected Accept or Reject and the date of the selection. It stays in the reader’s own browser and is not used to identify them. Plume asks for the choice again after 13 months, or sooner if the cookie categories change in a way that matters to readers. A reader who selects Reject can still read every article, and a reader who selected Accept can change that choice by clearing site data.

(a) Name: cookieChoice.
(b) Purpose: to remember the choice made in the banner.
(c) Lifespan: up to 13 months.
(d) Type: first-party preference.

If the Reject button is chosen, Plume stores only the choice itself, which is needed to avoid asking again on every page. The banner can be answered with a keyboard, and the choice applies to the browser in use and not to other devices. A reader who uses several browsers will see the banner once in each. Changing the choice requires clearing the site’s stored data in the browser, after which the banner appears again.

4. Analytics

Limited analytics may be enabled only after consent. An anonymous event identifier may be retained for up to 13 months to understand page performance and broad reading patterns.

Where analytics is enabled after consent, it records the page visited, the approximate region, the device category, and the time spent, using a random identifier rather than a name or email address. The results are used for editorial planning, such as noticing that a sleep guide is read more often on mobile devices. IP addresses are shortened or discarded where the tool allows it. When a reader selects Reject, no analytics identifier is created and only the banner choice is stored.

(a) Type: first-party analytics identifier, a random string.
(b) Lifespan: up to 13 months.
(c) Condition: set only after Accept.

Analytics results are viewed as totals and trends, such as how many visits a guide received in a month, and they are not used to follow an individual reader from page to page. Reports are available to members of the editorial desk and are not shared with advertisers. Raw event records are deleted or aggregated after the retention period shown on this page. If analytics were provided by an outside processor, the name of the processor and the region of processing would be added to this page before use.

(d) Data recorded: page, approximate region, device category, and time on page.
(e) Data not recorded: name, email address, and the content of messages.

5. No advertising tracking

Plume does not intentionally use cookies to follow readers across unrelated websites or to create sensitive advertising audiences. We do not sell cookie information.

Plume does not use remarketing tags, cross-site identifiers, or audience lists based on a reader’s health interests. Advertising partners, where they exist, are not given access to the browser entries described on this page. If Plume ever adds an advertising-related technology, this page would be updated with its name and lifespan beforehand, and consent would be requested again. This matches the approach set out in the Advertising and partnership policy.

Because Plume does not run advertising technology, there is no cookie on the site that supports interest-based advertising, and no cookie information is shared with advertisers. A banner choice does not change this, since nothing of the kind is active. Readers who see advertising on other websites are served by those websites and not by Plume.

(a) No remarketing or retargeting tags.
(b) No cross-site identifiers.
(c) No sale or exchange of cookie data.

6. Browser controls

You can clear or block cookies through browser settings. Blocking essential storage may affect preferences, but ordinary articles should remain readable.

Most browsers let a reader see stored entries, delete them, or block them for all sites or for chosen sites; the steps are usually found under Privacy or Security in settings. Private browsing windows delete entries when the window closes, which means the banner will be shown again at the next visit. Readers who use a shared computer should clear site data after a visit. Blocking third-party entries has no effect on how Plume’s pages work, because Plume does not rely on them.

In widely used browsers, the controls for cookies are found in the settings menu under Privacy and security. Readers can choose to block all cookies, block only third-party cookies, or clear entries every time the browser is closed. Mobile browsers offer the same controls, and the steps differ slightly between Android and iOS.

(a) The names of menus vary between browsers and versions, and the browser’s help pages describe the current steps.
(b) Deleting site data removes cookieChoice, and the banner will appear again at the next visit.
(c) Blocking all cookies may prevent the banner choice from being remembered.

7. Third parties

Infrastructure providers may process technical request data in other jurisdictions. They are expected to apply safeguards and use information only for contracted services.

Technical request data, such as an IP address and a page request, passes through hosting and security providers who may operate in Singapore or elsewhere in the Asia-Pacific region. These providers act on Plume’s instructions and are not permitted to use the data for their own marketing. A reader can ask the editorial desk for a description of the providers in use at a given time. The safeguards that apply to international processing are described in the Privacy policy.

Hosting and security providers receive the same request data any web server receives, such as the page requested, the time, the browser type, and the IP address. Providers are selected for their security practices, are bound by written terms, and are asked to delete or anonymise logs after a short period. Where processing takes place outside Indonesia, the safeguards follow Law No. 27 of 2022 on Personal Data Protection, which sets conditions for transfers and for the protection of the rights of data subjects.

(a) Hosting: delivers pages and keeps request logs for a limited period.
(b) Security services: filter abusive traffic.
(c) No provider is authorised to use request data for marketing.

8. Retention

Session data expires at session end. Preference data may last 13 months. Security records may be retained for 90 days, or longer where an incident requires investigation.

Retention periods start on the date an entry is created. A session entry ends when the browser closes, a preference entry ends at 13 months or earlier if the reader deletes it, and a security log ends at 90 days unless it is part of an inquiry. Where an inquiry applies, the relevant records are kept only as long as needed and are then deleted. Summaries that cannot identify a reader may be kept for editorial planning.

(a) Session identifier: until the browser is closed.
(b) cookieChoice: up to 13 months.
(c) Analytics identifier: up to 13 months, with consent only.
(d) Security records: 90 days.

A reader can ask for the deletion of records that relate to them by writing through contact.php. For identifiers held in the reader’s own browser, deletion is done by the reader, and Plume cannot link such an identifier to a person without further information. Security logs are deleted at the end of 90 days. After a retention period ends, any remaining summary has no identifier and is kept only as statistics.

9. Questions

Ask about cookies at Jalan Melati 15, RT.002/RW.005, Cilandak Barat, Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12430, Indonesia, or +62 812 5558 7643.

Questions are acknowledged within 5 working days and answered in substance within 30 days. A reader can ask what entries are stored for them, how to remove them, or how a banner choice is recorded. Messages sent through contact.php are handled under the Privacy policy, and the form shows a confirmation message after submission.

Questions can also be sent by telephone during weekday business hours in Jakarta, and a reader may ask for the answer in writing. A complaint about the handling of cookies can be raised first with the editorial desk, and if the response is not satisfactory, the reader may bring the matter to the authority responsible for personal data protection in Indonesia. Plume keeps a record of cookie-related questions for 12 months so that recurring confusion can be addressed on this page.

(a) Acknowledgement: within 5 working days.
(b) Substantive reply: within 30 days.
(c) Review of a reply: on request, by a different member of the editorial desk.

10. Revision log

This page was published and reviewed on 12 February 2026. Future changes will carry a date and describe any new category, provider, or retention period.

Log of changes:

12 February 2026: published the list of entries with names and lifespans, described the three categories, and added browser control steps and the question procedure.

Any later change will be listed here with its date.

Changes of substance, such as a new category, a new provider, or a longer lifespan, will be shown with a date at the top of the page and in this log, and the banner choice will be requested again. Changes of wording that do not affect the entries, such as corrected spelling, are made without a new log entry.

Additional log entry: 12 February 2026, added definitions of the technologies, the content of each entry, browser steps, a description of provider categories, and the deletion and complaint procedure.