BORRADOR — pendiente de revisión jurídica. No es una redacción final aprobada por asesoría legal.
Esta página legal se muestra en inglés. Los demás idiomas de la interfaz recurren al inglés hasta que se publique una traducción.
Cookie Policy
Versión 3.6.0 · En vigor desde 2026-08-01 · Última actualización 2026-08-18
Versiones anteriores
- 3.5.0 · 2026-08-01 — External-service naming audit 2026-08-18: Analytics activation wording; remove GTM/Consent Mode/Google Ads examples; keep Google Analytics.
- 3.4.0 · 2026-08-01 — Comparison audit 2026-08-14: under-16 analytics rule stated as product fact (no unsupported statutory attribution).
- 3.3.0 · 2026-08-01 — Formal re-audit 2026-08-13-3 (M-04): Google partner-site link; removed outstanding network-scan admission.
- 3.2.0 · 2026-08-01 — Formal legal re-audit draft (F-04): corrected PKE citation date to 12 July 2024 (Dz.U. 2024 poz. 1221).
- 3.1.0 · 2026-08-01 — Aug 2026 re-audit draft: marketing category not offered until tags exist; CMP aligned.
- 3.0.0 · 2026-08-01 — Re-audit: removed speculative Google Ads cookies; clarified marketing via GTM; cr_consent_id retention note.
- 1.0.0 · 2026-08-01 — First published draft.
This policy explains what we store on your device, why, and how to change your mind. It supplements the Privacy Policy.
1. The rule we follow
Under Article 399 of the Act of 12 July 2024 — Electronic Communications Law (Prawo komunikacji elektronicznej), Journal of Laws 2024 item 1221 (Dz.U. 2024 poz. 1221), which replaced Article 173 of the Telecommunications Law, we may store information on your device or read information already stored there only with your consent. Consent is not required where storage or access is strictly necessary to deliver a service you have requested, or to transmit a communication.
So: strictly necessary cookies are set without asking. Everything else waits for you to say yes, and nothing happens if you ignore the banner.
2. Analytics activation
Google Analytics is loaded only after you opt in to analytics cookies. Before you opt in, no analytics tag is loaded and no analytics data is sent to Google.
3. Strictly necessary cookies
These are always on. Without them the Service does not work.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
next-auth.session-token (__Secure- prefixed over HTTPS) | Keeps you signed in | 30 days | CramDeck |
next-auth.csrf-token | Protects sign-in forms against cross-site request forgery | Session | CramDeck |
next-auth.callback-url | Returns you to the right page after sign-in | Session | CramDeck |
NEXT_LOCALE | Remembers your interface language | 1 year | CramDeck |
cr_cookie_consent | Stores the choices you made in the cookie banner, so we do not ask again | 180 days | CramDeck |
cr_consent_id | A random identifier that lets us attach a consent record to a browser before you sign in, and merge it into your account when you do | 400 days | CramDeck |
cr_consent_id is a random value. It is not linked to your identity until you sign in. The cookie itself
lasts 400 days so we can prove what you consented to (Article 7(1) GDPR) and merge anonymous consent
history onto your account at sign-in. Retention of the linked consent events in our systems follows the
Privacy Policy (kept as long as needed to demonstrate compliance and for claims defence) — that
period is separate from the cookie’s 400-day lifetime.
4. Analytics cookies — only with your consent
Used to understand how the Service is used, so we can improve it. Off until you accept. We use Google Analytics 4 only after you consent to analytics cookies.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
_ga | Distinguishes browsers for Google Analytics | 2 years | |
_ga_<container> | Maintains the analytics session state | 2 years |
Information on how Google uses data from sites and apps that use Google services is available in Google's partner-site information.
5. Marketing cookies — not currently offered
We do not currently configure or load marketing or advertising tags. The cookie preferences interface therefore does not offer a marketing choice, and we do not collect a dormant marketing consent.
If we enable marketing tags later, we will:
- name every marketing cookie on this page before go-live;
- add a separate marketing choice to Cookie preferences; and
- load those tags only after marketing consent, independently of analytics.
Until then, accepting analytics does not enable marketing, and “Accept all” means accepting the optional categories that are actually offered (analytics only).
6. Local storage
We also use your browser's local storage for interface preferences such as theme and card order. This is not a cookie, it never leaves your device, and it is cleared when you clear site data.
7. Changing your choices
Open Cookie preferences in the footer at any time. You can grant or withdraw analytics consent. Withdrawing is as easy as granting, and takes effect immediately for future page loads. Withdrawal does not affect the lawfulness of processing carried out before it.
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you from signing in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy
- Edge: Settings → Cookies and site permissions
8. Users under 16
We do not use analytics cookies for accounts belonging to users known to be under 16, and we do not show them a consent choice for that category. Marketing cookies are not used for any user while none are configured. Only the strictly necessary cookies in section 3 are used for under-16 accounts.
9. Changes
We will update this page when we add or remove a cookie, with a new version number. Material changes reset your consent, and we will ask again.
Questions: hello@cramdeck.com · Privacy Policy