Cookie Policy
Last updated [[EFFECTIVE DATE]]
This is a working draft pending review by a qualified lawyer. Some details are still marked with placeholders. Do not rely on it as a final agreement.
1. What this policy covers
This policy explains how GeoPilot ([[SITE DOMAIN]]) uses cookies and similar technologies, what each one is for, and how you can control them. It supplements our Privacy Policy. Cookies are small text files a website stores in your browser; “similar technologies” include local storage and session storage.
2. Our approach
GeoPilot uses the smallest practical set of cookies:
- one cookie to keep you signed in;
- one cookie to remember your chosen language, set only when you pick a language with the language switcher;
- security cookies set by our content-delivery provider, Cloudflare.
We do not use analytics, advertising, profiling or cross-site tracking cookies. We do not use tag managers or marketing pixels. We do not sell your data. The Service also sends a Permissions-Policy header that opts out of the browser’s interest-based advertising features (the Topics API and FLoC).
Because the cookies and browser storage we use are either strictly necessary for a service you have asked for, or set only in response to an action you take (choosing a language), we do not display a cookie consent banner. If this changes — for example, if we add analytics — we will ask for your consent first.
3. Cookies we use
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
geopilot_session | GeoPilot | Keeps you signed in. The value is a random token; it holds no personal data and is stored only in hashed form on our servers. Without it you cannot stay logged in. | Strictly necessary | Up to 30 days from sign-in, and ends sooner after 14 days without use. HttpOnly, SameSite=Lax, Secure |
NEXT_LOCALE | GeoPilot | Remembers your interface language. Set only when you choose a language with the language switcher, so the next page opens in the same one. Opening a page in a particular language (for example a /ro/ address) does not set it. It holds only a language code. | Functional | 1 year. SameSite=Lax |
__cf_bm | Cloudflare | Distinguishes humans from bots to protect the Service from automated abuse. | Strictly necessary / security | About 30 minutes |
cf_clearance | Cloudflare | Records that a browser passed a security challenge, so it is not repeatedly challenged. | Strictly necessary / security | Set by Cloudflare |
| Cloudflare Turnstile cookie | Cloudflare | Only on the contact form and the API-access application form, and only if the anti-bot check is enabled. Confirms the check was completed so your submission can be sent. | Strictly necessary / security | Short-lived |
The exact Cloudflare cookie names and durations are set by Cloudflare and may change. See Cloudflare’s own documentation for the current list.
4. Third-party scripts
- Cloudflare sits in front of the whole Service as our content-delivery network and security layer. All traffic passes through Cloudflare, which processes connection data (including your IP address) to deliver content and block attacks.
- Cloudflare Turnstile loads a small script from
challenges.cloudflare.comon the contact form and the API-access application form only, and only when the anti-bot check is enabled.
We do not load any other third-party scripts. Our fonts are self-hosted (no request to a font CDN). Map tiles are downloaded by your browser directly from the map providers — this does not involve cookies, but those providers do receive your IP address; see the Privacy Policy.
5. Local and session storage
GeoPilot uses one item of session storage, and no local storage:
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
geopilot.pdraHandoff | GeoPilot | Carries a drawn area and the answers you gave in the map’s PDRA screening to the full screener when you click “Full screener”. Read once and then deleted. Never sent to our servers by this mechanism. | Strictly necessary | Until read, and at most 30 minutes; cleared when the tab closes |
Your map view (position, zoom, filters, chosen time, selected zone) is kept in the page URL so you can bookmark or share it — not in a cookie or browser storage — and we do not keep an offline cache or a local copy of your account.
6. How to control cookies
The session cookie and the Cloudflare security cookies are strictly necessary. If you block them, you will not be able to sign in, and parts of the Service may not work. You can delete the language cookie at any time; the Service then falls back to the address you open and your browser’s language setting.
You can see, block and delete cookies in your browser settings (Chrome: Settings → Privacy and security; Firefox: Settings → Privacy & Security; Safari: Settings → Privacy; Edge: Settings → Cookies and site permissions). We do not use tracking cookies, so a “Do Not Track” or Global Privacy Control signal has nothing to switch off here.
7. Changes and contact
We will update this policy if our use of cookies changes, and we will change the “Last updated” date above. Questions: [[PRIVACY EMAIL]].