Torsten Labs DOO · poolse
Cookie Policy
Every cookie and browser-storage item poolse sets, what it does, how long it lives, and how to change your choice.
This policy lists every cookie and browser-storage item poolse uses, on every surface we run: poolse.dev, dashboard.poolse.dev, and admin.poolse.dev. It is generated from the same inventory that drives the consent banner, so the two cannot say different things.
It sits alongside the Privacy Policy, which explains what we do with personal data more broadly.
1. The short version
- Strictly necessary cookies keep you signed in, protect our forms against forgery, and remember the choice you make about this banner. They are the only ones set before you decide anything.
- We use no analytics, no advertising pixels, and no cross-site tracking. Nothing is loaded in those categories today.
- We do not sell or share personal data, and we honour the Global Privacy Control browser signal.
- Your choice is stored for 12 months and can be changed from the "Cookie settings" link in the footer of every page.
- Refusing everything optional costs you nothing. The site works the same.
2. What these technologies are
A cookie is a small text file a site asks your browser to store and send back on later requests. Local storage and session storage work similarly but stay in the browser and are read by JavaScript rather than sent automatically with each request. Everything in this policy is treated the same way regardless of the mechanism — the law that matters here, Art. 5(3) of the ePrivacy Directive, is about storing or reading information on your device, not about the file format.
First-party items are set by poolse. Third-party items are set by another company on its own domain; for us that means only our payment provider, once self-serve checkout opens, and only if you actually start a checkout.
3. The legal basis, in one paragraph
Strictly necessary items are exempt from consent because they are essential to deliver a service you explicitly asked for. Everything else requires your prior, informed, freely given, specific, and unambiguous consent, which we ask for before setting anything and which you can withdraw as easily as you gave it. That is the standard under the ePrivacy Directive, Art. 4(11) and Art. 7 GDPR, and the matching provisions of North Macedonia's Law on Personal Data Protection. We apply it to every visitor worldwide rather than detecting where you are, because guessing your location is exactly the kind of processing you should not have to accept in order to say no to cookies.
4. Categories
Strictly necessary — always active
Required for the Service to function and to keep it secure. No consent is asked for these because without them you could not stay signed in, submit a form safely, or have your cookie preference remembered. Blocking them in your browser will break sign-in.
| Name | Type | Set by | Where | Purpose | Lifetime |
|---|---|---|---|---|---|
poolse_consent | cookie | poolse (first party) | All poolse websites | Stores your cookie choices, the version of the Cookie Policy you were shown, and the timestamp — so we can prove what you consented to and stop asking on every page. | 12 months |
__Secure-authjs.session-token | cookie | poolse (first party) | dashboard.poolse.dev | Keeps you signed in to the customer dashboard. Contains a signed session token, not your password. Named authjs.session-token on plain-HTTP local development. | 30 days, or until you sign out |
__Host-authjs.csrf-token | cookie | poolse (first party) | dashboard.poolse.dev | Cross-site request forgery protection for sign-in and account forms. Without it we cannot tell a genuine form submission from a forged one. | Session (deleted when you close the browser) |
__Secure-authjs.callback-url | cookie | poolse (first party) | dashboard.poolse.dev | Remembers the page you were heading to so you land there after signing in. | Session |
__Secure-authjs.pkce.code_verifier / __Secure-authjs.state | cookie | poolse (first party) | dashboard.poolse.dev | Short-lived OAuth security values used only while a Google or GitHub sign-in is in flight. They protect the exchange against interception and replay. | 15 minutes |
__Host-poolse-admin | cookie | poolse (first party) | admin.poolse.dev (staff only) | Signed session for poolse staff on the internal operator console. Never set for customers or visitors. | 8 hours |
poolse_admin_pending | cookie | poolse (first party) | admin.poolse.dev (staff only) | Carries the pending email address between the two steps of staff two-factor sign-in. Staff only. | 10 minutes |
poolse_showcase_session_id | localStorage | poolse (first party) | poolse.dev/chat | A random identifier that gives your browser a stable identity in the public chat demo, so your conversations survive a page refresh. It is not linked to your name, email, or any account, and it is created only if you open the demo. | Until you clear site data or reset the demo |
Lemon Squeezy checkout cookies | cookie | Lemon Squeezy, LLC (third party) | Lemon Squeezy hosted checkout | Not set today: self-serve checkout is not open yet. Once it is, our Merchant of Record sets these on its own checkout pages to run the payment, apply fraud checks, and honour a discount code, on Lemon Squeezy domains under its own policies, and only if you start a checkout. | See the Lemon Squeezy cookie notice |
Functional — off unless you allow them
Remember choices you make yourself, such as a collapsed docs section. Purely convenience; refusing them only means setting those preferences again next visit.
We currently set nothing in the “Functional” category.
Analytics — nothing set today
We run no analytics product: no Google Analytics, no session recorder, no heat mapping, no A/B testing tool. The category exists in the preference centre so your answer is already on record if we add privacy-respecting, first-party measurement later. If we do, we will name the provider here, update the version of this policy, and ask you again before anything loads.
We currently set nothing in the “Analytics” category.
Marketing — nothing set today, and none planned
No advertising networks, no retargeting pixels, no social-media trackers, no data brokers. We do not sell personal data and we do not share it for cross-context behavioural advertising as those terms are defined in the CCPA/CPRA and the other US state privacy laws.
We currently set nothing in the “Marketing” category.
5. Third-party cookies on the checkout
Self-serve checkout is not open yet; paid plans are currently invoiced by us directly, and no third-party checkout cookie is set. Once it opens, the checkout will run on infrastructure operated by Lemon Squeezy, LLC, our Merchant of Record. Lemon Squeezy sets its own cookies on its own domains to run the payment, screen for fraud, and apply a discount code. Those are governed by its privacy notice, not by this policy, and they are only ever set if you start a checkout.
Our edge and DNS provider, Cloudflare, may set a security cookie to distinguish automated traffic from human traffic during a challenge. Where that happens it is strictly necessary — it exists to keep the service reachable under attack — and it carries no advertising data.
6. Changing your mind
The same dialog is reachable from the Cookie settings link in the footer of every page. Withdrawing consent is one click and takes effect immediately: we stop setting anything in the refused category and delete the first-party items already stored under it. Withdrawal does not make earlier processing unlawful, and it does not affect strictly necessary cookies.
We will ask you again when your stored choice reaches 12 months, or sooner if we make a material change to this policy — a new category, a new provider, a new purpose. Version bumps invalidate the old record on purpose, because consent to an older version is not consent to a new one.
Browser-level controls
Every major browser lets you block or delete cookies and clear site data, usually under Privacy or Site settings. Blocking all cookies will sign you out and keep you signed out. Browsers also offer:
- Global Privacy Control — we honour it as a refusal of every optional category and as an opt-out of any sale or sharing of personal data. Supported natively in some browsers and via extensions in others.
- Do Not Track — never standardised and now largely abandoned, so we do not rely on it. GPC is the signal that carries legal weight; if your browser sends only DNT, use the cookie settings dialog to make your choice explicit.
7. What happens to the record of your choice
Your choice is stored in a first-party cookie named poolse_consent
containing the categories you allowed, the policy version you were
shown, a random record id, and a timestamp. We keep it for 12 months so
we can honour your decision and demonstrate it if a regulator asks —
which Art. 7(1) GDPR requires us to be able to do. It contains no name,
no email, and no advertising identifier, and it is never sent to a
third party.
8. Changes to this policy
Material changes are announced on the site, take effect on the date shown at the top of this page, and re-open the consent question. Clarifications and typographical fixes take effect on publication.
9. Questions
Write to [email protected]. Your rights, and how to complain to a supervisory authority, are set out in § 9 of the Privacy Policy.