Cookie Policy & Consent

1. What we use

We use cookies, local storage, and similar technologies for authentication, security, and preferences. We use strictly necessary technologies without consent (ePrivacy Art. 5(3) exemption); all others only with your consent.

If you choose Accept, we may also use optional client error diagnostics as described below.

If you choose Accept, we may also use optional analytics as described below.

If you choose Accept, we may also use optional analytics and client diagnostics as described below.

2. Strictly necessary

Without these, login and secure API calls will not work. Name — Purpose — Duration — Type:

web_access_token — Authentication — 15 minutes — HTTP-only, first-party

web_refresh_token — Session renewal — 7 days — HTTP-only, first-party

web_csrf_token — Anti-forgery — Session — First-party (readable by the app for double-submit CSRF)

__cf_bm (when Cloudflare sets it) — Bot protection — Up to 30 minutes — Cloudflare / first-party

cookieConsent (localStorage) — Stores your consent choice (status, version, timestamp) — 12 months — Local storage

3. Functional / preference

We store your cookie consent choice in local storage as described above. We may also store UI preferences you choose (for example theme or language). We do not place analytics identifiers in local storage.

4. Analytics

Google Analytics 4 loads only after you choose Accept in the cookie banner. It measures aggregated product usage such as registration and trip creation. Advertising storage and ad personalization stay disabled.

5. Diagnostics

The Sentry browser SDK loads after you choose Accept. It may send IP address, URL, stack traces, and technical device context to help diagnose client errors. Data may be processed in the United States (see Privacy Policy — International transfers). We do not use Sentry Session Replay. Choosing Essential only or resetting consent stops the browser SDK. Server-side Sentry may still process technical logs needed to operate the API.

6. Maps

MapLibre may load OpenStreetMap-based map tiles in the browser. Language flag icons may load from flagcdn.com; that request sends your IP address to the CDN.

7. CARTO

The browser loads map styles and tiles from basemaps.cartocdn.com (CARTO). CARTO may receive your IP address and approximate map viewport.

8. Unsplash

Cover images may load from images.unsplash.com in your browser. That request sends your IP address to Unsplash.

9. Google OAuth

When you choose Sign in with Google, you are redirected to Google. Google sets its own cookies on Google domains under Google's policies. We do not load Google Identity Services scripts before that choice.

10. Consent

On first visit we show a banner. Essential only keeps strictly necessary and functional technologies. Your choice is stored for 12 months (with a consent version and timestamp). If we make a material change to this Cookie Policy, we bump the consent version and ask again. You can change your choice anytime via Cookie preferences in the site footer or Manage cookie preferences on this page. The site remains usable if you choose Essential only.

Accept enables optional client diagnostics (Sentry browser SDK).

Accept enables optional analytics (Google Analytics 4).

Accept enables optional analytics and client diagnostics.

11. Manage and delete

Browser settings can clear cookies and storage. Clearing authentication cookies signs you out. Blocking all cookies may break login. For personal data rights, see Privacy Policy — Your rights (/legal/privacy#rights).

12. Changes

We may update this Cookie Policy. We will notify you by email or in the service at least 30 days before material changes take effect. Material changes also re-prompt the consent banner via an updated consent version.

13. Contact

PathChudo — [email protected] — or use the Contact page on the website.