Cookie Policy — pocket.ceo
Version: 1.2 · Effective date: 2026-10-12
This Cookie Policy describes how the pocket.ceo service (the “Service”, “we”, “us”) uses cookies and similar information-storage technologies on the user’s device. This document should be read together with the pocket.ceo Privacy Policy and Terms of Use.
This Policy covers:
- the pocket.ceo website, whose audience we measure without cookies (see section 3.2) and which remembers the language the user views it in, and
- the pocket.ceo web application, in which a first-party login session cookie is used.
The Service uses no analytics cookies and no advertising cookies, and does no marketing profiling.
1. Data controller / operator of the Service
The operator of the Service and the controller of personal data processed in connection with cookies is:
VALITY Łukasz Wątroba — sole proprietorship (jednoosobowa działalność gospodarcza, JDG) Registered address: Kretowskie 44, 43-436 Górki Wielkie, Poland NIP (Polish tax ID): 5472086879 REGON (Polish business register no.): 24361592800000 Registered in CEIDG (the Polish business register) Website: https://pocket.ceo
For any matters concerning cookies and the protection of personal data, please contact: hi@pocket.ceo.
2. What cookies are
Cookies are small text files stored on the user’s end device (computer, phone, tablet) when using the Service. Among other things, they allow a logged-in user’s session to be maintained.
In this Policy, “cookies” also means other comparable technologies used to store or access information on the end device (e.g. local storage mechanisms) where they are used for the same purposes.
We distinguish:
- first-party cookies — set by the Service itself (the pocket.ceo domain),
- third-party cookies — set by external providers. The Service sets none.
By purpose, we distinguish:
- strictly necessary cookies — required for the Service to function correctly (e.g. maintaining the login session); their use does not require user consent,
- cookies that require consent — any others, such as analytics or advertising cookies. The Service currently uses none (see section 5).
3. List of cookies used
3.1. Strictly necessary cookies (no consent required)
| Name | Provider | Type | Purpose | Storage period | Basis |
|---|---|---|---|---|---|
better-auth.session_token | First-party (pocket.ceo) | Necessary | Maintaining the session of an authenticated (logged-in) user of the web application; without this cookie, using the account is impossible | Up to 30 days; the session expires after that period or on logout | Necessity for providing the service requested by the user — no consent required (technical cookie) |
| OAuth login-flow cookies (including the state value and the PKCE verifier, set by our authentication library) | First-party (pocket.ceo) | Necessary | Securing the login process carried out through an external identity provider against CSRF attacks and interception of the authorisation code | Short-lived — until the login process is completed | Necessity for providing the service requested by the user — no consent required (technical cookie) |
pc_oauth_code_<identifier> | First-party (pocket.ceo) | Necessary | Linking a messenger that is connected through an authorisation flow (currently Discord): briefly holds the authorisation code returned by the messenger, so the linking can be completed without exposing the code in the page address. It is sent only to the channel-linking endpoints | Up to 10 minutes; deleted once linking is completed | Necessity for providing the service requested by the user — no consent required (technical cookie) |
In addition, the browser stores two entries comparable to cookies:
- in session storage (
sessionStorage), the keypocketceo.termsAccepted, confirming that the Terms of Use have been accepted before signing in; it disappears once the tab is closed; - in local storage (
localStorage), the keypocketceo.locale, holding only the language code of the website (e.g.pl) — the language chosen with the language switcher or, on the first visit, the one matching the browser’s language — so that the website opens in that language and does not redirect the user again. It stays until the browser’s data is cleared.
These cookies and entries serve solely to provide the service the user is using — signing in, linking a channel and showing the website in the user’s language — so their use does not depend on consent.
3.2. Audience measurement without cookies
We measure the website’s audience — how many people visit it and where they come from — without cookies. On selected public pages of the website we use Cloudflare Web Analytics, provided by Cloudflare, which already hosts the Service. This measurement:
- sets no cookies and stores nothing in the browser’s local storage — it neither writes to nor reads from the user’s device,
- uses no fingerprinting and does not recognise a returning visitor — a user is not tracked over time or across pages,
- never runs in the signed-in area of the Service — the application, onboarding and account pages are not measured,
- produces aggregate statistics only: which page was viewed, the referring page, the type of browser, operating system and device, the country of the visit, and page load performance.
We do not use this data for advertising or marketing profiling. Details of the processing — including Cloudflare’s role as our processor — are set out in the Privacy Policy.
4. Purposes and legal bases
| Category | Purpose | Legal basis |
|---|---|---|
| Strictly necessary cookies and entries (login, session, channel linking, site language) | Securing the login process, authentication and maintaining the logged-in user’s session; linking a channel; showing the website in the user’s language | Use of technical cookies necessary to provide the service requested by the user; processing of session data to perform the service contract (see the Privacy Policy) |
| Cookieless audience measurement (section 3.2) | Aggregate statistics on traffic to selected public pages of the website | Legitimate interest of the controller in knowing how the website is used (Art. 6(1)(f) GDPR). Consent is not required, because for this purpose nothing is stored on or read from the user’s device |
The obligation to obtain consent for storing and accessing information on the user’s end device (other than where strictly necessary) follows from the telecommunications / electronic-communications rules implementing Directive 2002/58/EC (ePrivacy); the processing of personal data linked to cookies is governed by the GDPR. As at the publication date, the national basis in force is the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, PKE), Article 399, which has been in force since 10 November 2024.
5. Consent
The Service currently uses no cookies that require consent, which is why there is no cookie banner. If we ever introduce such cookies, they will run only after the user has given consent in a banner, with accepting and rejecting equally easy — and as long as there is no banner, no such cookies are active.
6. Transfer of data outside the EEA
The cookies and entries listed in section 3.1 are first-party and involve no transfer of data to third parties. The cookieless audience measurement described in section 3.2 is carried out by Cloudflare, which operates data centres in the United States and in Europe; the basis for that transfer, together with all other data transfers relating to the operation of pocket.ceo, is described in the Privacy Policy.
7. Managing cookies in the browser
The user may manage cookies independently via their browser settings — including blocking, deleting or restricting their storage. The configuration method differs depending on the browser; instructions are available in the help sections of the most popular browsers (Google Chrome, Mozilla Firefox, Safari, Microsoft Edge).
Please note that blocking strictly necessary cookies (including the login and session cookies) makes it impossible to log in and use the account in the web application.
8. User rights
With respect to personal data processed in connection with cookies, the user has the rights described in detail in the Privacy Policy, including the right of access, rectification, erasure, restriction of processing, objection, and the right to lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).
9. Changes to the Cookie Policy
This Cookie Policy may be updated if the technologies used, providers, applicable law, or scope of the Service change. We will inform users of material changes within the Service. The current version of the Policy applies from the publication date indicated at the beginning of the document.