Cookie and local storage policy

1. Strictly necessary technologies

The Bookfilo session cookie (its technical name is configurable) identifies the authenticated session; it is HttpOnly, SameSite=Lax and normally expires after 120 minutes of inactivity. XSRF-TOKEN enables the browser to protect requests against CSRF forgery and follows the session lifetime.

bookfilo_oauth_browser securely links the browser to Google/Apple sign-in; it is HttpOnly, restricted to the OAuth route and expires after 10 minutes. The associated exchange code expires after 90 seconds and is consumed only once.

bookfilo_legal_consent_v2 (localStorage) records the decision, version, categories and date, including refusal, to respect your choice and avoid continually displaying the dialog. Authenticated user interface data is held only temporarily in page memory and is securely reloaded from the server session.

2. User-requested functional preferences

preferred_locale remembers the selected language for 12 months; theme (localStorage) remembers the light, dark or system theme until changed/deleted; local favourites remember identifiers of properties selected by visitors until removed or browser data is cleared.

These storage mechanisms fulfil user-requested actions or preferences and are not used for advertising. You can clear them through browser settings; you lose only the associated preference or local list.

2a. Internal visit counting

baap_visit_ping:* keys (sessionStorage) prevent repeat counting of a page on the current day and disappear when the browser session closes. Internal counting also uses server-side pseudonymous identifiers for statistics and ranking. In the current service these mechanisms operate independently of the Google Analytics choice. Statistical purpose or pseudonymisation does not automatically make them strictly necessary; legitimate interests do not replace consent required by law for device storage or access.

3. Optional analytics — Google Analytics

Google Analytics is currently the only implemented optional category. The Google script does not load before consent. When enabled, we send visited pages and interaction events; analytics_storage is set to “granted”, while ad_storage, ad_user_data and ad_personalization remain “denied”. Google Signals and ad-personalisation signals are disabled.

Google may set identifiers such as _ga for periods determined by the service and its configuration (usually up to 2 years). Current details: https://policies.google.com/technologies/cookies. Bookfilo may separately retain the optional technical data described in the Privacy Policy.

4. What we do not use in the current version

We do not activate Bookfilo behavioural marketing, retargeting or data-sale cookies and do not display switches for functions that do not exist. Social-network links are simple links; content from those services is not automatically embedded in the page.

Functional maps and location — Mapbox

Mapbox supplies the core map and location functions of Bookfilo. Maps initialise automatically on pages that use them, without separate optional consent, and there is no Mapbox off switch in Cookie preferences. Choosing “Necessary only” or withdrawing analytics consent does not stop these functions.

api.mapbox.com delivers map resources and events.mapbox.com receives usage/billing events with your IP address, browser information and related identifiers. Optional performance metrics are disabled, but usage/billing and style-load events remain active.

Mapbox GL JS uses localStorage keys with the prefix mapbox.eventData, including mapbox.eventData.uuid and mapbox.eventData.uuidTimestamp, for events and billing identifiers. The SDK rotates the identifier after approximately 24 hours; keys may persist between visits until updated by the SDK or cleared in your browser. You can clear them through browser settings; subsequent map use may recreate them.

Address/place searches use the Mapbox API to provide the requested function. Data, retention and possible USA transfers are described in our Privacy Policy and at https://www.mapbox.com/legal/privacy.

5. Choice, refusal and withdrawal

You may accept all optional tools, reject analytics or configure analytics in the consent dialog. Accept and reject buttons are offered at the same level. Core functions, including Mapbox, remain active regardless of your analytics choice.

You may reopen the dialog at any time through “Cookie preferences” in the footer. Withdrawal stops future optional analytics collection but does not automatically delete data already transmitted; for that data, you may exercise the rights in the Privacy Policy. You can manually clear cookies and local storage in your browser, in which case we will ask for your choice again.

6. Contact

For questions about these technologies or exercising your rights: [email protected]. The list may be updated when we introduce or remove a technology; any new non-essential category will remain disabled until consent.