Cookie Policy

This policy lists what our website and apps store on your device — cookies, and also local storage and session storage in your browser — and which outside services your device contacts. How we handle personal data in general is in the Privacy Policy.

The short version

Almost everything we store is needed for the platform to work: keeping you signed in, remembering your language and your choices, and securing card payments through Stripe. That needs no consent.

One thing is optional: maps. They load from OpenFreeMap, which sees your IP address, so the website shows a map only after you allow "Preferences". The cookie banner offers "Accept all" and "Reject all" with equal weight, and you can change your choice at any time.

We use no analytics, advertising or tracking cookies.

All storage listed as necessary below is strictly necessary for the service you asked for, including Stripe's fraud-prevention cookies at checkout. Maps need consent, which is why we ask.

Cookies on our website

• sb-<project-ref>-auth-token (sometimes split into .0, .1, …) — first-party cookie, set by Supabase, our sign-in provider. Keeps you signed in. Lasts 400 days and is renewed while you use the site; removed when you sign out. Necessary: sign-in.
• sb-<project-ref>-auth-token-code-verifier — first-party cookie, Supabase. Completes a sign-in with Google or Apple. Lasts until the sign-in is complete. Necessary: sign-in.
• NEXT_LOCALE — first-party cookie. The language you picked. Lasts 1 year. Necessary: a setting you chose.
• theme — first-party cookie. The appearance you picked: Light, Dark or Auto (follows your device). Lasts 1 year. Necessary: a setting you chose.
• flash — first-party cookie. A one-off confirmation after a page change, such as "Saved" or "Account deleted". Lasts at most 60 seconds and is deleted once shown. Necessary: your own action.
• sb_consent_id and sb_consent — first-party cookies, set by the cookie banner. Your cookie choice and the ID of its record. Last 12 months. Necessary: your cookie choice.
• __stripe_mid and __stripe_sid — first-party cookies, set by Stripe at checkout. Fraud prevention and 3-D Secure for the card payment you asked for. Last 1 year and 30 minutes. Necessary: security of your payment.
• Stripe's own cookies (in the m.stripe.network frame) — third-party cookies, Stripe. Same purpose; Stripe sets their lifetime. Necessary: security of your payment.

Stripe loads only at checkout, and only after you press "Load the secure payment form". Stripe acts under its own privacy policy; its data may be processed in Ireland and the United States.

Other storage in your browser

• stripe-payment-consent — local storage. Remembers that you chose to load the payment form. Stays until you clear it. Necessary: your own action.
• sb.checkout.<selection> — session storage. One key per chosen time slot, so reloading the page never books twice; it holds no card data. Gone when you close the tab. Necessary: your own action.
• messages.scanningDismissed — local storage. You closed the note that messages are checked for contact details. Stays until you clear it. Necessary: a setting you chose.
• host.calendar.view — local storage, hosts only. The calendar view you picked. Stays until you clear it. Necessary: a setting you chose.
• sb.legal.later and sb.legal.hostNotice — session storage. You chose "Not now" on the terms screen, or closed the notice about new Host Terms, in this tab. Gone when you close the tab. Necessary: a setting you chose.
• sb.consent.synced — session storage. This tab has already linked your cookie choice to your account. Gone when you close the tab. Necessary: your cookie choice.

Optional: maps (Preferences)

• Map tiles and style from OpenFreeMap (tiles.openfreemap.org). They draw the maps on the website. Your browser fetches them from OpenFreeMap's servers, which receive your IP address; nothing is stored on your device. Until you allow "Preferences", a placeholder stands in for each map, and you can allow maps right there or in Cookie settings.

Requests to other services that store nothing

• Fonts: the website uses its own copies. Our emails load their fonts from Google Fonts when you open them, so Google sees your IP address.

In the apps

The apps store on your device your sign-in session, the language and appearance you picked, messages that haven't been sent yet, and whether you closed the note that messages are checked for contact details. The Stripe payment module runs only when you pay by card. The apps show no maps and contain no analytics, advertising or tracking tools.

Your cookie choice

When you choose in the banner, we save a record with a random ID, the four categories (necessary, preferences, analytics, marketing), the banner version and the time — and your account, if you are signed in, so your choice follows you to other devices. We don't store your IP address or browser details with it. We ask again after 12 months, or sooner if the banner changes.

Managing storage

You can change your choice at any time under Account → Legal & privacy → Cookie settings. You can also delete cookies and site data in your browser settings; you will then be signed out, and the site will forget your language and your choice.

Contact

Questions: contact@cogitocode.ro.