01Cookies and similar technologies
Cookies are small pieces of information stored by a browser. LocalStorage stores data locally until it is removed, while sessionStorage normally stores data until the browser tab or session is closed. Laws governing access to information on a device cover not only traditional cookies but also similar storage mechanisms.
The Operator identified in the Privacy Policy is responsible for first-party technologies.
02Current storage inventory
| Name / type | Purpose | Duration | Category |
|---|---|---|---|
| session and login-refresh cookies (HttpOnly) | Maintain a secure session for a logged-in User. | According to the session configuration; until logout or expiry. | Strictly necessary |
csrf (where deployed) | Support protection of state-changing operations against CSRF attacks. | For the session or the period configured by the production backend. | Strictly necessary |
isLoggedIn, user — localStorage | Remember login state and basic display data; no access token is stored. | Until logout, Account deletion or storage is cleared. | Strictly necessary / functional |
matchdays_cart — localStorage | Preserve the cart selected by the User. | Until products are removed or storage is cleared. | User-requested function |
matchdays_watchlist_* — localStorage | Preserve a watchlist, including for a guest User. | Until the list is removed or storage is cleared. | Functional |
matchdays.add-listing.draft.v1 — localStorage | Automatically save an in-progress Listing without photographs. | Up to 14 days or until the draft is published or deleted. | Functional |
matchdays.view.<id> — sessionStorage | Limit the view count for a Listing to one view per browser session. | Until the browser session ends. | Analytics — consent decision required before production |
Before launch: cookie names and durations set by the backend must be confirmed after the final domain configuration. Automatic view counting must either remain disabled until consent is obtained or be covered by a working consent mechanism before the first storage write and event transmission.
03Consent and legal basis
Technologies necessary to transmit a communication or provide a function expressly requested by the User may operate without separate consent. This applies in particular to login, deployed CSRF protection, security, the cart and saving a draft that the User has started.
Analytics, advertising, personalisation and social technologies that are not necessary may be enabled only after voluntary consent. Refusal must be as easy as acceptance, and withdrawing consent must not prevent basic use of the Platform.
04Managing settings
Users can remove cookies and site data in their browser settings. Removing necessary data may sign the User out or clear the cart, watchlist or Listing draft. If optional technologies are introduced, the Platform must provide a permanent “Cookie settings” link through which consent can be changed or withdrawn.
05Third-party technologies
Payment, video, embedded-content, analytics or support providers may use their own technologies only when the relevant integration is actually enabled. Before adding a provider, the Operator should identify the names, purposes, durations, recipients and required consent basis and then update this table and the consent-management mechanism.
06Changes and contact
This inventory is updated when storage mechanisms or providers change. Questions may be sent to info@matchdays.store.