DRAFT — pending legal review. Not final counsel-approved wording.
Cookie Policy
Version 1.0.0 · Effective 2026-08-01 · Last updated 2026-07-25
This policy explains what we store on your device, why, and how to change your mind. It supplements the Privacy Policy.
1. The rule we follow
Under Article 399 of the Polish Electronic Communications Law of 12 May 2023, which replaced Article 173 of the Telecommunications Law, we may store information on your device or read information already stored there only with your consent. Consent is not required where storage or access is strictly necessary to deliver a service you have requested, or to transmit a communication.
So: strictly necessary cookies are set without asking. Everything else waits for you to say yes, and nothing happens if you ignore the banner.
2. Strictly necessary cookies
These are always on. Without them the Service does not work.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
next-auth.session-token (__Secure- prefixed over HTTPS) | Keeps you signed in | 30 days | CramDeck |
next-auth.csrf-token | Protects sign-in forms against cross-site request forgery | Session | CramDeck |
next-auth.callback-url | Returns you to the right page after sign-in | Session | CramDeck |
NEXT_LOCALE | Remembers your interface language | 1 year | CramDeck |
cr_cookie_consent | Stores the choices you made in the cookie banner, so we do not ask again | 180 days | CramDeck |
cr_consent_id | A random identifier that lets us attach a consent record to a browser before you sign in, and merge it into your account when you do | 400 days | CramDeck |
cr_consent_id is a random value. It is not linked to your identity until you sign in, and it exists so that
we can prove what you consented to, as Article 7(1) GDPR requires.
3. Analytics cookies — only with your consent
Used to understand how the Service is used, so we can improve it. Off until you accept.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
_ga | Distinguishes browsers for Google Analytics | 2 years | |
_ga_<container> | Maintains the analytics session state | 2 years |
Google Tag Manager itself does not set cookies, but it loads the tags that do. We load neither until you accept analytics cookies. We use Google Consent Mode v2, which means Google's tags receive an explicit signal about your choice and stay in a restricted mode until you consent.
4. Marketing cookies — only with your consent
Used to measure advertising and, where enabled, to show relevant advertising elsewhere. Off until you accept, and separate from analytics: accepting one does not accept the other.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
_gcl_au | Attributes a visit to an advertising click | 90 days | |
NID, IDE | Advertising personalisation and measurement on Google domains | Up to 13 months |
We do not offer marketing cookies to users under 16.
5. Local storage
We also use your browser's local storage for interface preferences such as theme and card order. This is not a cookie, it never leaves your device, and it is cleared when you clear site data.
6. Changing your choices
Open Cookie preferences in the footer at any time. You can grant or withdraw analytics and marketing consent separately. Withdrawing is as easy as granting, and takes effect immediately for future page loads. Withdrawal does not affect the lawfulness of processing carried out before it.
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you from signing in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy
- Edge: Settings → Cookies and site permissions
7. Users under 16
Polish law sets the age at which a child can consent to information society services on their own at 16. We therefore do not use analytics or marketing cookies for accounts belonging to users under 16, and we do not show them a consent choice for those categories. Only the strictly necessary cookies in section 2 are used.
8. Changes
We will update this page when we add or remove a cookie, with a new version number. Material changes reset your consent, and we will ask again.
Questions: hello@cramdeck.com