Cookie and Tracker Notice
- Effective date:
- Last updated:
The short version
This website uses a small number of cookies to work at all — to keep you signed in, to carry a sign-in attempt from one step to the next, and to remember the choice you make about this very notice. Those are the only ones we set without asking.
Beyond that there is exactly one optional thing: Google Analytics, so we can see which pages help people and which ones lose them. It does not load, and sets no cookie, unless you turn it on. If you say no, nothing from Google is requested at all — not the script, not a pixel, nothing.
We run no advertising cookies, no tracking pixels, no social media plugins, and no "people who viewed this also viewed" profiling. Our fonts are served from our own servers rather than Google's.
This notice is the document referred to as the Cookie and Tracker Notice in our Privacy Policy and Terms of Use.
1. What a cookie is here
A cookie is a small file a website asks your browser to keep. Some are set by us (first-party); some can be set by other companies whose code runs on the page (third-party). The same rules cover comparable techniques — local storage, pixels, device fingerprinting.
For completeness: this website uses no local storage, no session storage, and no IndexedDB. Everything below is a cookie.
Under the ePrivacy rules, cookies that are strictly necessary to provide a service you asked for do not need your consent. Everything else does, in advance. That distinction is what the table below is organised around, and we have tried to be honest about which side each cookie falls on rather than labelling everything "essential".
2. Cookies we set
Strictly necessary — no consent needed
| Cookie | What it does | How long |
|---|---|---|
libelo_session | Keeps you signed in. Contains your access and refresh tokens, encrypted — the contents are unreadable to your browser and to anyone reading the cookie. | 30 days |
libelo_flow | Holds a sign-in, sign-up or password-reset attempt together across its steps, including the email address you entered. Encrypted. | 10 minutes |
libelo_pkce | Security values that prove a Google or Apple sign-in came back to us unmodified (a PKCE verifier and state). Encrypted. | 10 minutes |
libelo_consent | Remembers what you chose about this notice, so we don't ask again on every page. | 6 months |
The first three are set only if you use an account. If you never sign in, you never get them.
A technical note, because it looks odd in a browser's cookie list: the three encrypted cookies are too large for a single cookie, so each is split across up to eight numbered parts — libelo_session.0, libelo_session.1, and so on. They are one cookie doing one job, not eight separate ones.
Functional
| Cookie | What it does | How long |
|---|---|---|
libelo_flags | Unlocks a pre-release feature for your browser when you follow a link we have given you containing ?flags=. Only ever set if you follow such a link deliberately. | 1 year |
Analytics — only with your consent
| Cookie | Set by | What it does | How long |
|---|---|---|---|
_ga | Tells one visitor apart from another, using a random identifier. | 2 years | |
_ga_<id> | Keeps track of the current visit. | 2 years |
These appear only after you agree. Turn analytics off again and we delete them.
3. Other things your browser loads
These are not cookies, and none of them identifies you by name — but they all involve your browser contacting somebody else's server, which means that server sees your IP address. We would rather list them than pretend the page is served entirely by us.
| Who | When | What they receive |
|---|---|---|
| MapTiler (Switzerland) | On any page with a map — /map, park and highlight pages | Your IP address and which part of the map you are looking at. Needed to draw the map at all. |
| Microsoft Azure Blob Storage (EU) | On pages showing photos | Your IP address, and which image was requested. |
| Klaviyo (United States) | Only when you submit the newsletter form or the contact form | Your IP address and what you typed — your email, and for the contact form your name and message. Nothing is sent before you press the button. |
| Google Analytics (United States) | Only if you consented to analytics | Pages viewed, approximate location from IP, device and browser type. |
Your browser may also ask for your location on the map page. That is a browser permission, not a cookie: your device asks you, we never see an answer unless you allow it, and you can take the permission back at any time in your browser settings. We use it to centre the map on you, nothing else.
Transfers outside the EEA — Klaviyo and Google — are covered in section 7 of our Privacy Policy.
4. Changing your mind
Use the Cookie settings link in the footer of any page. It opens the same panel you saw the first time, and takes effect immediately — including deleting the Google Analytics cookies if you switch analytics off.
We will ask again after six months, or sooner if we add something new that needs your agreement.
You can also clear or block cookies in your browser. Blocking the strictly necessary ones will stop you being able to stay signed in, but the rest of the site will work.
5. When this notice changes
Every tracker on this website is added by changing our source code, which means it goes through review and shows up in this notice at the same time. We do not use a tag manager that would let a tracker be added to the site without that. If we ever add a new category of cookie, we will ask you again rather than assume your previous answer covers it.
6. Questions
Write to info@libelo.app, or by post to Libelo sp. z o.o., ul. Władysława Pytlasińskiego 16/13, 00-777 Warszawa, Poland. Full company details are on our Imprint page.