Cookie Policy

How Dopomo uses cookies

We use cookies sparingly. Strictly-necessary cookies and a single language-preference cookie always operate so the service works. For traffic measurement we use cookieless analytics. We also use Google advertising and measurement cookies — for ad attribution and conversion measurement — which are optional, denied by default under Google Consent Mode v2, and load only if you accept them in our cookie banner; you can change or withdraw that consent at any time.

July 17, 2026

What cookies are

Cookies are small text files saved by your browser on your device. They let a site remember certain information between visits — for example your chosen language or the fact that you are logged in.

How we use them

Cookies and browser storage run the service: keeping your login session, remembering the interface language, and providing basic security — these are strictly necessary and always on. Separately, we use Google advertising and measurement cookies for ad attribution and conversion measurement; these are optional and require your consent. Because of them we show a cookie banner: optional cookies are off by default (Google Consent Mode v2) and load only if you accept, and you can change your choice at any time.

The types we use

Essential — necessary for the service to work. Without them, login and basic features will not work. The session cookies are marked HttpOnly, meaning they are not accessible to page scripts.

Name	Purpose	Duration
better-auth.session_token	Keeps your session after you log in with the magic link.	7 days
better-auth.session_data	A short session cache.	about 5 minutes
better-auth.dont_remember	A “don’t remember me” flag.	Session
__cf_bm / cf_clearance	Bot protection at the network edge (Cloudflare).	Short-lived
rp_anon_quota	Enforces the monthly free allowance of 3 chat messages for signed-out users (renews monthly on a rolling window from the first message, abuse prevention). First-party, HttpOnly, content-free, no tracking.	13 months
better-auth.better-auth-passkey	If you turn on passkey sign-in (passkey / WebAuthn — e.g. Face ID or a fingerprint), this cookie holds a single-use cryptographic challenge only for the duration of one sign-in or passkey registration. It is not used for analytics or tracking.	Short-lived (one ceremony)

In production, the session cookies carry the secure __Secure- prefix. We provide CSRF protection through HTTP headers, without a separate cookie.

The invisible Cloudflare Turnstile bot check we use on sign-up and chat forms sets no cookies of its own. The __cf_bm / cf_clearance cookies above are Cloudflare’s general edge bot-management cookies, separate from Turnstile.

Preferences — remember your settings so you do not have to choose them each time.

Name	Purpose	Duration
NEXT_LOCALE	Remembers your chosen interface language.	1 year

Browser storage (local storage)

Besides cookies, we use browser storage to a minimal extent. In local storage we keep only a note that you dismissed the app-install prompt (pwa-prompt-dismissed, about 30 days). In session storage we keep a technical error-tracking key (Sentry). We do not store any data about your case, or any sensitive data, in your browser.

Analytics (cookieless)

To understand how people use Dopomo and to improve the service, we measure traffic with Matomo configured in a cookieless mode. Matomo stores no cookies or other identifiers on your device, anonymises your IP address, and does not track you across services. We look only at aggregate data — which pages are visited and where in the journey people drop off — not at any individual’s profile.

Matomo (InnoCraft) is hosted in the European Union and acts as our processor under a data-processing agreement. Because the Matomo analytics store nothing on your device, they require no cookie consent. We do show a cookie banner, but it is for the optional Google advertising and measurement cookies described under Third parties, not for this cookieless analytics.

You can opt out of measurement in two ways: (a) turn on the “Do Not Track” setting in your browser — we honour it, and because the analytics are cookieless, opting out needs no file; (b) use the Matomo opt-out form. The form then stores a single strictly-necessary cookie remembering your opt-out choice — this is the only case in which the analytics set any cookie.

Third parties

For traffic measurement we use cookieless Matomo analytics (described above), hosted in the EU. For error monitoring we use Sentry (EU), which does not set its own cookies.

We use Google’s advertising and measurement tags (Google Ads and Google Analytics) to attribute visits to our ad campaigns and to measure conversions. These can set Google advertising and measurement cookies. They operate under Google Consent Mode v2: by default they are denied and set no such cookies; they activate only if you accept marketing cookies in our banner, and you can withdraw that consent at any time. Legal basis: your consent (GDPR Art. 6(1)(a)). We do not sell your data, and we do not share it with third parties for their own advertising.

When you arrive from a Google ad, the ad-click identifier (gclid) may be stored on our servers for up to 90 days, linked to a payment order, solely to measure that conversion; it is shared with Google for ad attribution and with no other third party.

Online payments (e.g. for the CUKR case) are made by redirecting you to the Autopay payment provider’s page. Any cookies set on the payment page are governed by Autopay’s cookie policy on its domain, not ours. If in the future we embed an Autopay payment script or widget on our own page, we will update this policy.

How to manage them

You can delete or block most cookies in your browser settings. Bear in mind, however, that blocking essential cookies will make login and the use of some features impossible. You can clear browser storage by clearing the site data in your browser.

You can read more about how we process data in the Privacy Policy.