Cookie Policy

1. Necessary website storage

Shared Expo web app: gjejbej.session uses session storage until sign-out or the tab session ends. Preferences use local storage. The Next.js records below describe the previous site; not every client creates all these records.

app_language: a first-party cookie set when you choose English or Albanian, retained for one year. It remembers your requested language.

gjejbej-auth: first-party local storage used for your signed-in session, tokens and profile cache. Supabase uses sb-<project-ref>-auth-token for its session. These records remain until sign-out, replacement or browser-data clearing; local storage has no automatic cookie-style expiry. Session validity is checked separately.

gjejbej.auth.returnPath: session storage for returning to the page you requested after Google sign-in. It is removed when consumed or when the tab session ends. Supabase may also temporarily store sign-in flow or verification state.

gjejbej-terms-pending: session storage for your affirmative terms choice during Google or Apple sign-in. It is accepted for 30 minutes, removed after completion and otherwise lasts until the tab session ends. It is not a marketing preference.

gjejbej-cookie-preferences: A preference left by an earlier release. The current release does not read or write this preference.

2. Optional content and analytics

This release has no integrated visitor analytics, advertising pixels, social-media embeds or advertising SDKs. Google and Apple sign-in are separate authentication choices.

Google Maps loads automatically in map views on iOS, Android and web when configured. Google receives map areas and connection data such as IP addresses even without GPS permission. Nominatim/OpenStreetMap handles place searches and names for selected points, receiving the query or coordinates and connection data. Device location permission is a separate choice.

3. Mobile device storage

The app keeps credentials and preferences in device storage. The random gjej.product.installation identifier registers one push route per installation to avoid duplicate delivery; it is not an advertising identifier. Google maps load automatically while GPS is requested separately. This policy does not claim a blanket native-app exemption from device-storage consent requirements. Clearing local storage does not delete the server account.

4. Your controls

You can browse public listings without an account. Sign out to end your session; clear site data through your browser to remove browser storage. Blocking necessary storage may prevent sign-in or remembering your language. External Google Maps, WhatsApp and sign-in links open providers with their own privacy rules.

If analytics, advertising or other non-essential device storage is introduced, it must remain disabled until any required consent is obtained, with an equally accessible refusal and withdrawal option. This policy does not authorise future tracking.