Cookie policy

Draft — the text is still being reviewed by a lawyer.

Version: draft of 3 October 2026. Details in square brackets are not filled in yet or still need to be confirmed.

Cookies are small files a website stores in your browser. Browser storage (localStorage, sessionStorage) and the IndexedDB database work in a similar way; in this policy we call all of them cookies.

We use strictly necessary cookies without consent, because the site cannot work without them (Croatian Electronic Communications Act). We use analytics cookies only if you accept them.

For each entry we list: name · type and who sets it · purpose · duration.

• __session · cookie, Buqtivity · the language you chose (the only cookie our server reads) · 1 year
• firebase:authUser:… · IndexedDB (firebaseLocalStorageDb), Google Firebase Authentication · keeps you signed in · until you sign out
• bqt-signed-in · local storage, Buqtivity · whether you are signed in, so the sign-in code loads only when needed · no expiry (changes on sign-in and sign-out)
• bqt-account-email:… · local storage, Buqtivity (… is the account id) · the account's last verified e-mail address in this browser, so a change reaches your profile · no expiry
• cart · local storage, Buqtivity · the id of your cart · until the order is completed or the cart emptied
• cookie-status · local storage, Buqtivity · your cookie choice · 12 months, then we ask again
• __stripe_mid, __stripe_sid · cookies, Stripe (checkout page only) · fraud prevention during payment · 1 year / 30 minutes [for the lawyer: durations from Stripe's documentation, check]
• _GRECAPTCHA · cookie or local storage, Google reCAPTCHA (sign-in, sign-up, password reset) · protection against automated attacks · 6 months [for the lawyer: check the duration and whether reCAPTCHA counts as strictly necessary]

[for the lawyer: Firebase may also create helper IndexedDB databases in the browser (e.g. firebase-heartbeat-database, firebase-installations-database); check in a browser and add them.]

• ui-theme · local storage, Buqtivity · how the site looks (season, night mode, high contrast) · no expiry
• recentlyViewedProducts · local storage, Buqtivity (only when you are not signed in) · recently viewed events · no expiry

These entries serve only you, stay in your browser and are sent to nobody, so they are stored without consent. [for the lawyer: confirm that these preferences need no consent.]

• ph_…_posthog · local storage, PostHog (servers in the EU; … is the project key) · an anonymous browser identifier, the session and analytics settings · until you withdraw consent, when it is deleted [for the lawyer: no expiry of its own]
• other PostHog entries with the project key · local and session storage, PostHog · session recording and the course of the visit · until the tab is closed or consent is withdrawn
• __ph_opt_in_out_… · local storage, PostHog · records your consent or refusal, so analytics do not start before the check · stays after consent is withdrawn
• _ga, _ga_… · cookies, Google Analytics (Firebase) · telling visitors and visits apart · 2 years

Analytics are not loaded until you accept cookies. Session recordings hide everything you type, and all text on the account, cart and checkout pages. More about this data in the Privacy policy.

Sentry (servers in the EU) sets no cookies and stores nothing in your browser, so it does not depend on your cookie choice. When an error happens on the site, it sends the technical data described in the Privacy policy. [for the lawyer: error reports currently run without consent; confirm, or tie them to consent.]

On your first visit the site asks whether you accept analytics cookies; the "Accept" and "Decline" buttons are equally prominent. Your choice is kept for 12 months.

You can change it at any time with the Cookie settings link at the bottom of the page. When you withdraw consent, PostHog stops and its entries are deleted; delete the Google Analytics cookies in your browser settings. [for the lawyer: the Google Analytics cookies are not yet deleted automatically when consent is withdrawn.]

You can also delete or block cookies in your browser settings; if you block the strictly necessary ones, sign-in and the cart may not work.

Questions about cookies and personal data: [E-mail]. When we add or remove a cookie, we update this policy and the date at the top of the page.