1What cookies and local storage are
Effective date: 14 November 2026.
A cookie is a small text file a website saves in your browser. Local storage works in a similar way but stays in your browser and is not sent with every request. The law (the EU ePrivacy Directive, the UK PECR and similar rules) lets a site store what is strictly necessary for a service you asked for; anything else needs your consent.
2Strictly necessary (always on)
Name What it does Type Kept for theme Remembers light or dark mode Local storage Until you clear it NEXT_LOCALE Remembers the language you chose First-party cookie 1 year cookie-consent Remembers your privacy choice and when you made it Local storage Until you clear it Cloudflare Turnstile Checks that the contact form is sent by a person, not a bot. Loaded only on the contact page; it reads technical signals from your browser and does not track you across sites. Security service by Cloudflare For the visit koby_device A random identifier set when you send the contact form, so repeated or abusive submissions can be limited. Contains nothing about you and is not readable by scripts. First-party cookie (HttpOnly) 1 year theme
- What it does
- Remembers light or dark mode
- Type
- Local storage
- Kept for
- Until you clear it
NEXT_LOCALE
- What it does
- Remembers the language you chose
- Type
- First-party cookie
- Kept for
- 1 year
cookie-consent
- What it does
- Remembers your privacy choice and when you made it
- Type
- Local storage
- Kept for
- Until you clear it
Cloudflare Turnstile
- What it does
- Checks that the contact form is sent by a person, not a bot. Loaded only on the contact page; it reads technical signals from your browser and does not track you across sites.
- Type
- Security service by Cloudflare
- Kept for
- For the visit
koby_device
- What it does
- A random identifier set when you send the contact form, so repeated or abusive submissions can be limited. Contains nothing about you and is not readable by scripts.
- Type
- First-party cookie (HttpOnly)
- Kept for
- 1 year
These do not need consent because the site cannot work properly or safely without them.
3Analytics (only with your consent)
Name What it does Type Kept for Vercel Web Analytics and Speed Insights Counts page views and measures page speed in aggregate, so we can improve the site. No cookies, no cross-site identifiers, no advertising. Cookieless analytics by Vercel Nothing is stored on your device Vercel Web Analytics and Speed Insights
- What it does
- Counts page views and measures page speed in aggregate, so we can improve the site. No cookies, no cross-site identifiers, no advertising.
- Type
- Cookieless analytics by Vercel
- Kept for
- Nothing is stored on your device
These load only after you choose “Allow analytics”. If your browser sends a Global Privacy Control signal, we treat it as a “no” and analytics stay off.
4What we never use
No advertising cookies, no tracking pixels, no social media trackers and no selling or sharing of browsing data. We do not build profiles of visitors.
5Changing your choice
Open “Your privacy choices” in the footer of any page to allow or refuse analytics at any time. Refusing is as easy as allowing, and the site works the same either way. You can also delete stored data in your browser settings; the site will then ask again.
6The parent web panel and the apps
The parent web panel at app.withkoby.com is a separate site with its own privacy choices. It stores:
Name What it does Type Kept for koby_sid Keeps you signed in. Contains only a random session reference; the session itself is held on our servers First-party cookie (HttpOnly, SameSite=Strict) 12 hours, or 30 days if you choose to stay signed in device-id Identifies this browser so a stolen session cannot be used elsewhere and abuse can be detected. Made of a random value and a summary of browser characteristics computed in your browser; nothing is sent to a third party to compute it Local storage Until you clear it lang, theme, consent, lastActivity and display settings Remember your language, theme and privacy choice, lock the panel after inactivity, and remember table and sidebar settings Local storage Until you clear it Cloudflare Turnstile Checks that sign-in and sensitive forms are used by a person Security service by Cloudflare For the visit Browser notifications Only if you turn on notifications: a push token so we can send them Service worker (Firebase Cloud Messaging) Until you turn them off or sign out _ga, _ga_* Google Analytics for Firebase, only after you choose to allow analytics, with advertising features off. Never loaded while a child is signed in; the cookies are deleted when you withdraw consent Analytics cookies (Google) Up to 2 years in the browser; data kept 2 months koby_sid
- What it does
- Keeps you signed in. Contains only a random session reference; the session itself is held on our servers
- Type
- First-party cookie (HttpOnly, SameSite=Strict)
- Kept for
- 12 hours, or 30 days if you choose to stay signed in
device-id
- What it does
- Identifies this browser so a stolen session cannot be used elsewhere and abuse can be detected. Made of a random value and a summary of browser characteristics computed in your browser; nothing is sent to a third party to compute it
- Type
- Local storage
- Kept for
- Until you clear it
lang, theme, consent, lastActivity and display settings
- What it does
- Remember your language, theme and privacy choice, lock the panel after inactivity, and remember table and sidebar settings
- Type
- Local storage
- Kept for
- Until you clear it
Cloudflare Turnstile
- What it does
- Checks that sign-in and sensitive forms are used by a person
- Type
- Security service by Cloudflare
- Kept for
- For the visit
Browser notifications
- What it does
- Only if you turn on notifications: a push token so we can send them
- Type
- Service worker (Firebase Cloud Messaging)
- Kept for
- Until you turn them off or sign out
_ga, _ga_*
- What it does
- Google Analytics for Firebase, only after you choose to allow analytics, with advertising features off. Never loaded while a child is signed in; the cookies are deleted when you withdraw consent
- Type
- Analytics cookies (Google)
- Kept for
- Up to 2 years in the browser; data kept 2 months
The Koby apps use no cookies, no advertising identifiers and no usage analytics. Crash reports from the apps are sent without account identifiers. How the apps handle data is explained in the privacy policy.
7Questions
Write to . We update this policy when what the site stores changes; the date at the top shows the latest version.