Legal / Updated 14 October 2026
Cookie policy
How Derive uses small browser files and similar technologies.
1. What cookies do
A cookie is a small value stored by a browser for a defined purpose. It can remember a preference, support a session, or help a publisher understand grouped reading patterns. Derive keeps the number of cookies limited and does not use them to create a sensitive profile.
2. Essential preference
The cookieChoice value records whether a reader accepted or rejected optional measurement. It is stored for 180 days and contains only the word accept or reject. Removing browser storage will make the banner appear again.
3. Session information
Where a technical service requires a session identifier, it is intended to last only while the browser session is active. It helps protect forms and maintain basic navigation. We do not use a session value to infer private characteristics.
4. Measurement
If optional measurement is enabled, grouped page information may be recorded for up to 13 months. Reports are used to understand which explanations are useful and whether pages load reliably. Readers can reject optional measurement without losing access to articles.
5. Preferences
Future reader preferences may include display or language settings. Such values will be named in a future update and will have a stated lifespan. We avoid storing a preference when it is not needed for the selected feature.
6. Third parties
Hosting, security, and measurement partners may set or read values only where their service requires it and where the reader has chosen optional cookies. Their own notices may explain additional technical processing. Derive does not permit advertising partners to build an independent reader list.
7. Browser controls
Most browsers allow cookies to be blocked, removed, or limited by site. Blocking essential values may affect the banner or form behavior. Help pages from the browser maker explain the relevant controls more accurately than a universal instruction.
8. Consent
The banner offers Accept and Reject choices. Rejecting optional cookies does not prevent ordinary reading. We keep the choice so the question is not repeatedly shown during the 180-day period.
9. Do not track
Browser privacy signals vary in support and meaning. Derive reviews signals alongside the visible cookie choice and aims to honor a clear refusal of optional measurement. We do not treat a missing signal as permission for unrelated purposes.
10. Retention
Cookie lifespans are selected to match the purpose: session values expire with the session, cookieChoice expires after 180 days, and optional measurement identifiers may last no more than 13 months. Server-side reports follow the retention limits in privacy.php.
11. Changes
This page is effective 14 October 2026. A new date will appear if a technology, partner, or lifespan changes. Readers can revisit this page from the footer on every site page.
12. Contact
Questions about cookies can be sent through contact.php or by post to 120 Cihampelas Street, Bandung, West Java 40131, Indonesia. We can explain the purpose of a value without asking for unnecessary personal information.
The cookieChoice value is a first-party preference and is not used as an account identifier. A reader who selects reject can continue to read the publication, submit ordinary editorial correspondence, and revisit the choice later by clearing site data or using the available cookie controls. The value may be recreated after a browser reset because the site cannot read a previous decision once local browser storage has been removed.
For clarity, the current technical categories are limited to the following named values where the relevant feature is enabled: cookieChoice, lasting 180 days for the optional-measurement choice; deriveSession, a temporary session value that expires when the browsing session ends; and an optional measurement identifier, lasting no more than 13 months and used only for grouped reports. Names may vary if a hosting or security provider requires a technical cookie, and any material change will be recorded in this policy before that category is introduced.
Hosting and security services can process an IP address, request time, user-agent string, and an error or abuse indicator in server logs. These values support delivery, rate limiting, and investigation of unusual traffic; they are not used by Derive to create advertising audiences. A measurement provider, if enabled, may receive page path, referrer, approximate region, device category, and event time. Reports are configured to avoid collecting message contents or precise location.
Some service providers may operate infrastructure outside Indonesia. Derive reviews the provider's privacy terms, contractual duties, access controls, and transfer safeguards before enabling optional measurement or a new technical service. You may contact the editorial desk about a cookie concern at 120 Cihampelas Street, Bandung, West Java 40131, Indonesia, or +62 22 731 8975. We aim to acknowledge a request within 10 working days and answer it within 30 calendar days. This policy was reviewed on 14 October 2026 and is scheduled for review in October 2027.
Cookies do not replace the site's ordinary privacy notice; they are one technical way information can remain available between requests. A first-party preference can make a banner choice easier to respect, while a session value can help a form distinguish one browsing session from another. A cookie cannot by itself explain who a reader is, and Derive does not treat a browser value as proof of identity. Readers can continue reading the publication when optional cookies are declined.
The named first-party preference is cookieChoice, with a lifespan of 180 days and a value limited to accept or reject. A temporary technical value may be named deriveSession and is intended to expire when the browsing session ends. If optional grouped measurement is enabled, its identifier is limited to a period of no more than 13 months and is configured to avoid message contents and precise location. These lifespans are reviewed when a provider or site feature changes.
Hosting and security services may process request time, IP address, browser details, and an abuse or error signal in server logs. Those logs support delivery, rate limiting, form protection, and troubleshooting, and may be retained for up to 90 days. A grouped measurement provider may receive page path, approximate region, device category, referrer, and event time when the reader has chosen that option. The provider is not authorized to use Derive correspondence to build an independent advertising list.
Browser controls can remove a value, block future values, or limit them to a particular site. Removing cookieChoice will cause the preference prompt to appear again because the site cannot recover a deleted decision. Blocking a technical session value may affect a form or navigation feature, but it should not prevent access to ordinary articles. Help pages from the browser maker describe the available controls for the selected device.
Some hosting, security, or measurement infrastructure may be outside Indonesia. Before enabling a new service, Derive reviews the provider's privacy notice, access controls, contractual duties, and available transfer safeguards. Cookie questions can be sent to 120 Cihampelas Street, Bandung, West Java 40131, Indonesia, or +62 22 731 8975. We aim to acknowledge a request within 10 working days and answer it within 30 calendar days. This policy was reviewed on 14 October 2026 and is planned for review in October 2027.