What cookies are
Cookies are small text files your browser stores on your device. Local storage (localStorage) and session storage (sessionStorage) in the browser work in a similar way. Together they enable core platform functions like sign-in and remembering your chosen language.
Cookies we set
We use essential cookies only, with no analytics and no marketing. All of them are first-party and none is used for tracking.
- sb-<project-ref>-auth-token (may be split into parts .0, .1 and so on): the Supabase sign-in session. HTTP-only and Secure, lasts at most 400 days and is removed when you sign out. Required for sign-in and to keep your session secure.
- sb-<project-ref>-auth-token-code-verifier: a temporary HTTP-only cookie set only while you reset a forgotten password by email.
- atc_recovery: HTTP-only, 15 minutes. Confirms that the session was opened from a password-reset link, so that only that route allows a new password without the old one.
- atc_staff_device: HTTP-only, 30 days, staff accounts only (moderators, coordinators, administrators). Set after a correct email code, and means this device does not need a new code until it expires.
- atc_lang: 1 year. Language preference (BHS / EN) for pages that have a single address, such as sign-in and the dashboard. Public pages take their language from the address (the English version lives under /en), so this cookie never changes their language. It holds no personal data.
Browser storage
- atc_lang (localStorage): the same language preference as the cookie.
- atc_cookie_consent (localStorage): the version of this policy and the time you acknowledged the cookie notice, so we do not ask again.
- atc_pilot_dismissed (localStorage): remembers that you closed the pilot-phase ribbon.
- atc_viewed:<type>:<id> (sessionStorage): stops the same profile, package or article being counted more than once in the same tab. No identifier is sent; it is removed when you close the tab.
- atc_email (sessionStorage): the email address you just entered to register or sign in, so the email confirmation page can show it and resend the link. It stays in that tab only and is removed when you close it.
Third-party services
The sign-in and registration pages load Cloudflare Turnstile, a check that you are not a bot. Maps load map tiles from OpenStreetMap, and profile and package videos play through Cloudflare Stream. These services receive your IP address when they load; see the Privacy policy for details. Our pages set no third-party analytics or marketing cookies.
Consent
Because we use only essential cookies and storage, consent is not required under Art. 5(3) of the ePrivacy directive; the processing rests on GDPR Art. 6(1)(f). If in the future we introduce analytics or marketing cookies, we will display a consent banner and ask for your explicit opt-in for those categories.
Cookie controls
You can delete or block cookies and storage in your browser settings. Blocking essential cookies prevents signing in to the platform.
Contact
For cookie or privacy questions email support@agrotour.eu. For full rights information see the Privacy policy.