Cookies and browser storage policy

Controller and scope

This policy concerns Merito Media LLC and https://www.movieresort.com in Spanish, English, French, Italian, German and Portuguese. Use the contact form for questions. The legal notice identifies the publisher.

Preferences are not synchronised with other group publications. Different domains, browsers or devices can have separate choices.

Cookies and similar technologies

Cookies are stored by the browser and sent to the relevant domain. HttpOnly cookies cannot be read by JavaScript. localStorage does not transmit itself automatically, but our code can read it and send particular information to the server for a feature.

Server logs and the subscriber database are different from cookies. The inventory lists names and patterns, never session values, credentials or private tokens.

What is active

We use sessions, form protection, appearance and territory preferences, a newsletter invitation marker and, after voluntary activation, notification management data. The inventory distinguishes page-load storage from action-dependent storage.

The reviewed version has no Google Analytics, advertising tags or newsletter opening pixels. Advertising or affiliate funding does not mean such trackers are active. No first-party sessionStorage or IndexedDB use was identified; this is not a description of storage inside external providers.

Sessions, authentication and security

The server sets movieresort-session and XSRF-TOKEN on reading pages too. They support session state and request-forgery protection. In production they are host-only, path /, Secure and SameSite=Lax; only the session cookie is HttpOnly. Application responses renew expiry: this is not an absolute lifetime from the first visit.

Selecting Remember me after a valid Admads login creates a persistent authentication cookie. Reading does not create a public account. Contact and signup use locally served ALTCHA on submission; its optional cookie setting is not enabled. Challenges and server-side replay prevention last ten minutes.

Preferences, invitations and notifications

The theme is stored when you use the selector; otherwise the system appearance preference is read without saving it. Language is in the URL. The territory cookie is created or renewed only when a request explicitly selects a country, including a filter URL.

The automatic newsletter invitation may open after about one second on editorial pages. A dated dismissal stops being applied after 30 days. Requests store requested and confirmations store confirmed to suppress automatic invitations while those states remain. They contain no email and do not by themselves prove consent. The footer card can still open the form manually.

Push requires channel selection, consent and browser permission before generating a local management key and registering a service worker and browser subscription. The key is sent to MovieResort to manage preferences, not measure browsing. The worker does not intercept pages or cache reading content.

Maps, images and external video

Opening Contact automatically connects to Google Maps and discloses the connection, IP address and browser technical data without a MovieResort-managed prior permission. It does not request geolocation. Ignoring the map does not prevent that initial connection, although the address and form remain usable.

This review could not verify all names and lifetimes of cookies or storage accessed by the map and its subresources. A direct HTTP request returned 403; that does not establish absence of browser cookies. This uncertainty and lack of prior controls are limitations, not a verified exemption.

The code supports manually loaded YouTube privacy-enhanced trailers, but production had no usable trailers on 21 October 2026. We do not invent a typical player cookie inventory for an unobserved player. Loading video is not consent to every provider processing purpose.

Sampled images are served by MovieResort. Credits and source links are not embedded social posts. Any external image elsewhere connects to its server; this review cannot guarantee the absence of third-party technology in all future resources.

Choices currently available

There is no cookie consent manager or functioning accept, reject or category-settings panel. We do not display fictional controls. Browsing, scrolling or dismissing the newsletter invitation does not constitute cookie or subscription consent.

The site has no option to reject the map before loading or withdraw a map authorisation afterwards. Browser blocking is possible, but does not replace prior consent where required. This behaviour is retained with its limitations documented; this policy is not evidence of universal compliance.

Changing choices and permissions

Change the theme in the header and territory through available filters. Clearing site data removes local preferences and may restore the invitation. The site does not automatically delete Google cookies or data.

To stop push, disable all channels in Manage notifications; browser permission can also be revoked. Opting out does not automatically delete the management key. Deleting the key alone does not prove cancellation and may prevent management from that browser.

Email unsubscribe uses the newsletter link and website confirmation. It is independent of cookies and push. Accepting technology does not subscribe you; clearing cookies does not unsubscribe you.

Providers and data processing

Merito Media LLC manages first-party storage and locally hosted ALTCHA. Google provides the map under its own policies and decisions, not merely as a MovieResort processor. The responsible Google entity depends on region and service terms: Google Ireland Limited or Google LLC.

Google may process information outside the EEA. Specific destinations and safeguards for this integration have not been verified here; MovieResort hosting location does not eliminate transfers. Provider policies supplement, not replace, the automatic-loading disclosure. See Privacy for other processing and rights.

Browser, links and communications

Browser settings can inspect, block or delete cookies, storage and permissions. Deletion may end sessions, break forms or reset appearance. These measures complement feature controls; they do not create a MovieResort consent manager.

External destinations have their own terms. Affiliate links may identify the commercial referrer there. The sample did not identify a first-party conversion pixel or a visitor identifier added before leaving; this is not a claim that all third parties are tracker-free.

Email images can be requested when opened even without an opening pixel. Public newsletter web versions contain no recipient-specific links. Personal confirmation and unsubscribe links manage those actions, not visit measurement.

Persistence and scope

Inventory lifetimes concern browser storage or the indicated configuration; browser restrictions and deletion can shorten them. Renewal is separate from initial creation. Server or provider data has its own retention and is not necessarily deleted when a cookie expires.

localStorage does not expire by itself: data remains until deleted, but MovieResort stops applying invitation dismissals after 30 days. Other markers remain until deletion. They are shared across six languages on the same origin, not across HTTP/HTTPS, subdomains or other sites. There is no general category-based consent history.

Updates and review limits

The 21 October 2026 review compares code, effective configuration, Set-Cookie headers and representative pages. No forms, push permissions or campaigns were activated for testing. Storage inside every external frame and every browser was not fully audited.

Changes in technology, purposes or controls require reviewing this policy; text updates alone do not authorise new purposes. European and Spanish guidance informs the review, with applicability depending on establishment and relevant territories. Report discrepancies through the form.