The True Malaysia · Legal
Cookies Policy
Draft — owner and legal review required. This document describes how the website works today and has not been reviewed by qualified counsel. The revision date below is when it was written, not an effective date.
This page lists everything The True Malaysia stores in your browser, what each item is for, how long it lasts and where in this website's code it comes from.
It is a short list, because this website carries no analytics, no advertising and no third-party tracking. Rather than ask you to take that on trust, the inventory below names each item individually.
1. Cookies, and the two things that are not cookies
A cookie is a small file a website asks your browser to keep and send back on later requests. Most of what this website stores is not a cookie at all, and the difference matters because the two behave differently.
- Local storage stays in your browser until something clears it, and is never attached to a request. This website uses one local-storage item: your cookie-preference record.
- Session storage is cleared when you close the tab, and is also never sent to a server. This website uses it to hold your trip-planner selections while you are still working on them.
- A cookie proper is sent with each request. This website sets exactly one, and only for administrators signing in to the private admin area.
2. The full inventory
| Name / key | Technology | Provider | Purpose | Category | Duration | Set when | Scope | Evidence |
|---|---|---|---|---|---|---|---|---|
| ttm-cookie-preferences | Local storage | This website (first party) | Records the choice you make in Cookie Preferences so you are not asked on every visit. | Strictly necessary | 365 days, then re-asked | Only when you save a choice | Public pages | src/components/legal/CookieConsentManager.tsx |
| Trip-planner selections | Session storage | This website (first party) | Keeps your in-progress island trip-planner choices so they survive moving between pages. | Functional | Until the browser tab is closed | When you use the trip planner | Public pages | src/data/tripPlanner.ts |
| Administrator session | Cookie (httpOnly, secure in production, SameSite=Lax, path /) | This website (first party) | Keeps an administrator signed in to the private admin area. It is a signed token and holds no browsing history. | Strictly necessary | Set at sign-in with a fixed lifetime, deleted at sign-out | Only on administrator sign-in | Admin area only — a public visitor never receives it | src/server/auth/session.ts, src/server/auth/jwt.ts |
That is the complete list of what this website's own code stores. There is no analytics cookie, no advertising identifier, no tag manager, no pixel and no cross-site tracker, because no such service is present anywhere in the codebase.
3. What this inventory cannot see
This list was produced by reading the website's source code. That method is reliable for anything the website itself sets, and blind to two things:
- Whatever the production web server or a load balancer in front of it may set of its own accord — a routing or session-affinity cookie, for example. The hosting arrangement is not finalised, so this cannot be checked yet.
- Whatever a content delivery network or edge proxy might add if one is introduced later.
This is recorded as an open audit gap rather than resolved by assertion. Once the hosting is settled, a check in a clean browser against the live site must confirm this inventory and anything found must be added to it.
4. Links out, and why they are different
This website links to Malaysian ministries, agencies, chambers and associations constantly, and that is the point of it. A link is not an embed: nothing is loaded from those websites while you read this one, and they cannot set anything in your browser unless you follow the link. Once you do, their own cookie practices apply.
No external content is embedded in these pages — no map, no video player, no social feed, no comment system, no font request. The typefaces are downloaded when the website is built and served from this website's own address.
5. Changing your choice
Cookie Preferences is in the footer of every page, and on this page beside the print button. It opens the same panel from anywhere, shows what is stored and records your choice.
There is one control in that panel rather than an Accept and a Reject pair. With nothing optional in use, the two buttons would save exactly the same answer, and offering a choice that makes no difference is a worse kind of dishonesty than offering none. If an optional category is ever introduced it will appear in the panel switched off, with separate Accept, Reject and Save controls, and it will not run unless you turn it on.
You can also clear everything from your browser's own settings — site data for this address — which removes the preference record along with the rest. Your browser can block cookies and storage entirely; this website is built to keep working if you do, though the preference panel will then ask again on each visit because it has nowhere to remember your answer.
6. Withdrawing consent
Because there is nothing optional today, there is nothing to withdraw: the two items in the inventory are the preference record itself and a session-scoped convenience, and neither tracks you.
If that changes, withdrawing will take effect from the moment you save it, not from your next visit — the website re-reads your choice immediately and stops making the requests that category covered. Known first-party items in that category are removed where the browser allows it. Two honest limits apply to any website: a third-party cookie set under another company's address can only be cleared through your browser or that company, and data already transferred before you withdrew cannot be recalled by the act of withdrawing.
7. Changes to this Policy
The date at the top is when this draft was written, not an effective date. The document takes effect when the owner approves it.
It will be revised whenever an item is added to or removed from the inventory, and whenever the hosting arrangement changes in a way that affects Section 3. The preference record carries a version number, so a material change can ask you again rather than inheriting an answer you gave about something else.
The True Malaysia
Powered by Erawan, a product of Petrol Solution Co., Limited.
- Contact:
- Contact page
- Website:
- www.thetruemalaysia.com
Not yet published here, because none has been confirmed: the data controller and contracting entity, a registered office address, a dedicated privacy contact, a data protection officer, and the production web address. Each is recorded for owner and legal decision rather than filled in with a placeholder.
