Cookie and Local Storage Policy for Struvo

Version: 1.0
Effective Date: [INSERT DATE, E.G. OCTOBER 1, 2026]
Last Updated: [INSERT DATE]

---

1. Introduction

1.1. This Cookie and Local Storage Policy explains how Struvo (accessible at struvo.pl and its subdomains) utilizes cookies, HTML5 Local Storage, and Session Storage.

1.2. The controller of the website and web application is: [LEGAL ENTITY NAME / FULL NAME], registered at: [REGISTERED ADDRESS], Tax ID (NIP): [NIP NUMBER], email: privacy@struvo.pl.

1.3. This Policy complies with Article 5(3) of the EU ePrivacy Directive (Directive 2002/58/EC as amended), national implementing telecommunications laws, and the GDPR.

1.4. Governing Language Clause: This Policy is established in the Polish language and translated into English. In the event of any discrepancies, the Polish version shall be authoritative and controlling.

---

2. What Are Cookies and Web Storage?

2.1. Cookies: Small data files placed on your browser or device by a web server, used primarily for maintaining user sessions.

2.2. Local Storage and Session Storage (HTML5 Web Storage): Modern client-side storage technologies allowing web applications to store data within your browser. Session Storage is cleared when the browser tab is closed, whereas Local Storage persists until explicitly cleared by the application (e.g., during logout) or by the user.

---

3. Necessary mechanisms and optional analytics

3.1. Necessary storage supports authentication, security, the selected organisation, registration and export in progress, and recording your cookie choice. Interface preferences support a setting you select. Calling storage “functional” does not exempt it from consent where it is not necessary for a requested service.

3.2. With your voluntary consent, we use PostHog for feature usage statistics and web application error diagnostics. Analytics is off by default. Refusal does not restrict core features or sign-in. This consent is not used for behavioural advertising.

3.3. Analytics may include user and session identifiers, pages visited, usage events, browser details and errors. After sign-in, events may be linked to an account identifier, name, email address and role. These are therefore not exclusively anonymous statistics. See the Privacy Policy.

---

4. Browser storage inventory

An asterisk represents keys suffixed with a user, organisation or project identifier. Browser storage duration is separate from server retention.

Name	Type	Purpose	Local storage duration
__Host-struvo_session	HttpOnly, Secure, SameSite=Lax cookie	Web session identifier; authentication tokens are held server-side	Up to 8 hours or earlier logout
__Host-struvo_oauth	HttpOnly, Secure, SameSite=Lax cookie	Binds sign-in to the browser	Up to 10 minutes; removed when the flow ends
__Host-struvo_registration	HttpOnly, Secure, SameSite=Lax cookie	Completing registration	Up to 30 minutes or earlier completion
tyb_user	Local Storage	Account context, memberships and permissions displayed in the interface	Until logout or clearing site data
tyb_active_company:*	Session Storage	Organisation selected in the current tab	Until logout, a changed selection or end of tab session
tyb_session_redirect, tyb_registration, tyb_social_invite, tyb_reg_draft_v1	Session Storage	Redirects, invitation and registration form; the form draft does not store a password	Until the relevant flow ends, storage is cleared or the tab session ends
Keycloak sign-in cookies, e.g. AUTH_SESSION_ID	Identity server cookies	Sign-in and SSO session	Depends on identity server settings; the detailed inventory and duration require deployment verification
struvo_cookie_consent	Local Storage	Choice version, analytics consent/refusal and decision date	Choice valid for 180 days; overwritten by a new choice and removable in the browser
structura_theme_mode, legacy structura_theme	Local Storage	Interface theme	Until changed or site data is cleared
tyb_locale	Local Storage	Selected language	Until changed or site data is cleared
tyb_locale	First-party cookie shared by the Struvo website and application	Remember an explicitly selected language before rendering the page	Up to 1 year, or until changed or deleted
tyb_photo_exports:*	Local Storage	Photo exports in progress	Until the job is removed from the local list or storage is cleared
ph_*, __ph_opt_in_out_*	Local Storage / auxiliary SDK storage	PostHog identifiers and state for optional analytics	Identifiers are cleared by the application on withdrawal of consent; Local Storage has no automatic expiry of its own

Legacy keys tyb_access, tyb_refresh, tyb_id, tyb_state and tyb_code_verifier are removed by the current web application. They do not describe current session token storage.

---

5. Legal basis and managing your choice

5.1. Storage and access are governed by Articles 399 and 400 of the Polish Electronic Communications Law of 12 July 2024. Exemption from consent is limited to Article 399(3), including mechanisms necessary for a service requested by the user. Optional analytics requires prior consent; personal data processing also relies on Article 6(1)(a) GDPR.

5.2. Choose necessary storage only, allow analytics, or change your choice through Cookie settings in the footer or application privacy settings. Withdrawing consent stops further collection by the analytics integration and clears its local identifiers. It does not affect the lawfulness of earlier processing or automatically request erasure of everything previously sent to the provider. Send such a request to privacy@struvo.pl.

5.3. You can clear or block site data in browser privacy settings. Clearing session cookies may interrupt sign-in; clearing Local Storage may reset preferences and your cookie choice. Clearing Local Storage alone does not replace logout and server-side session revocation. Analytics requires fresh consent when no valid choice remains.

---