Cookie Policy

Effective date: June 2, 2026 Title: Cookie Policy

Controller:
This website is operated by the “Controller”. You can contact us regarding privacy questions or data requests via our contact page: https://www.glutenfreemap.es/contact

1. Summary

We use cookies and similar technologies to ensure our site functions correctly, primarily to enable user authentication and secure your session.

Currently, our site only uses strictly necessary cookies for user login.

We also use Vercel Analytics and Umami, both in their privacy-first, cookieless configuration, to gather aggregated website performance and usage metrics. This analytics processing is conducted on the basis of our legitimate interest to improve the site.

Beyond cookies, some features use first-party local storage in your browser to remember choices you make (for example, that you dismissed an optional form) and to complete actions you start. This storage is technical and functional, first-party only, and is not used for marketing or cross-site tracking. It is described in Section 3.C below.

We do not use any non-essential cookies (e.g., for marketing or third-party tracking). If we add any non-essential cookies, we will update this policy and request your consent.

2. What are cookies?

Cookies are small text files placed on your device (computer, phone, or tablet) by a website when you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

  • Session cookies: These are temporary and are deleted when you close your browser.
  • Persistent cookies: These remain on your device for a set period or until you delete them.

This policy also covers other local storage technologies. We use a small amount of first-party local storage for technical and functional purposes (described in Section 3.C); we do not use local storage for marketing or third-party tracking.

3. Technologies We Use

We categorize the technologies we use as follows.

  • A. Strictly Necessary Cookies These cookies are essential for you to move around the website and use its features, such as accessing secure areas. Without these cookies, services you have asked for (like logging in to your account) cannot be provided. These cookies do not require your consent.

    • Cookie Name: auth-token
    • Purpose: To keep you logged in to your account, secure your session, and allow you to use account-only features (like posting reviews).
    • Provider: glutenfreemap.es (via our auth provider, Supabase)
    • Duration: 7 days (or until you log out). This is a persistent cookie so you do not have to log in every time you visit.

  • B. Analytics (Based on Legitimate Interest) These technologies help us understand how our website is performing and how users interact with it. Under the GDPR, we process this data on the legal basis of Legitimate Interest (Article 6(1)(f)) to improve our service. This data is aggregated and does not identify you personally.

    • Technology: Vercel Analytics

    • Purpose: To measure website performance, track page views, and gather anonymous, aggregated statistics to help us improve the site's speed and usability.

    • Provider: Vercel

    • Data Collected: This service operates in a cookieless mode, meaning it does not store any cookies, localStorage, or other files on your device. It gathers anonymized data from server logs, such as event name, browser, operating system, and country.

    • Right to Object: Under the GDPR, you have the right to object to processing based on legitimate interest. If you wish to object to our use of Vercel Analytics, please contact us at https://www.glutenfreemap.es/contact with your request.

    • Technology: Umami

    • Purpose: To measure page views and product engagement (such as how many users install or open our app) using anonymous, aggregated statistics.

    • Provider: Umami Software, Inc. (Umami Cloud)

    • Data Collected: This service operates in a cookieless mode and does not store any cookies, localStorage, or other files on your device. It collects anonymized data such as event name, page URL, referrer, browser, operating system, device type, and country.

    • Right to Object: Under the GDPR, you have the right to object to processing based on legitimate interest. If you wish to object to our use of Umami, please contact us at https://www.glutenfreemap.es/contact with your request.

  • C. Functional / Technical Local Storage (First-Party) In addition to the authentication cookie above, some pages store small values in your browser's local storage to remember choices you make and to complete actions you start. These entries are first-party only, are never shared with third parties, and are not used for advertising or cross-site tracking. Under the ePrivacy Directive and AEPD guidance they are technical/functional storage necessary to deliver features you actively use, so they do not require a consent banner; we disclose them here for full transparency.

    • Name: gfm_country_done

    • Purpose: Remembers that you have already submitted or dismissed our optional country-expansion form, so we do not prompt you again.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: gfm_ph_ref

    • Purpose: Remembers that you arrived from a specific campaign link (e.g., a product launch) so we can show you the relevant welcome experience and attribute the visit. First-party only; not used for advertising.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: gfm_pending_request_id

    • Purpose: Temporarily links a country-expansion request you submitted to your account if you sign in immediately afterward, so your request is not lost. Removed automatically once linked.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Temporary (removed after linking).

    • Name: gfm_donate_suppressed_until

    • Purpose: Remembers to temporarily suppress donation prompts after you dismiss or interact with them, to avoid spamming you.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (temporary suppression window of 21 days).

    • Name: isBannerDismissed

    • Purpose: Remembers that you dismissed the site's top welcome/announcement banner so it doesn't reappear on subsequent visits.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: gfm:installPromptDismissedAt

    • Purpose: Remembers the timestamp when you dismissed the PWA app-install prompt to apply a cooldown period before prompting again.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (cooldown of 14 days).

    • Name: gfm:installed

    • Purpose: Remembers if you have successfully installed the PWA application on your device to prevent showing installation prompts.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: glutenfree_reported

    • Purpose: Stores the IDs of restaurants you have reported, preventing duplicate report submissions from the same browser.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: glutenfree_voted_restaurants

    • Purpose: Remembers the IDs of restaurants you have voted on, enabling vote state tracking and preventing duplicate voting.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

    • Name: glutenfree_vote_nudge_dismissed

    • Purpose: Remembers that you dismissed the vote nudge prompt so you are not asked again repeatedly.

    • Provider: glutenfreemap.es (first-party)

    • Duration: Persistent (until you clear your browser storage).

4. Future Cookie Use

If we add more cookies in the future, we will classify them as follows and request your consent before they are set:

  • Analytics / Performance Cookies: Measure usage, pageviews, and error tracking (e.g., Google Analytics).
  • Functionality Cookies: Remember preferences (like language or region).
  • Marketing / Targeting Cookies: Enable ads or collect browsing habits for advertising.

5. Your Consent

Because we currently only use strictly necessary cookies, we do not require a granular cookie consent banner. We inform you via a site notice that these essential cookies are in use to provide the service. Our analytics are cookieless and processed under legitimate interest. We also use first-party functional/technical local storage (see Section 3.C) on the same basis: it is not used for tracking or advertising and therefore does not require consent.

If we introduce any non-essential, cookie-based technologies (like marketing or functionality cookies), we will implement a consent modal. This modal will block all non-essential cookies by default until you provide explicit, opt-in consent.

6. How to Control or Delete Cookies

You can control and/or delete cookies as you wish using your browser settings. You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed.

If you do this, however, you may have to manually adjust some preferences every time you visit a site, and some services and functionalities (like logging in) will not work.

  • Chrome: Settings → Privacy and security → Cookies and other site data
  • Firefox: Settings → Privacy & Security → Cookies and Site Data
  • Edge: Settings → Cookies and site permissions → Manage and delete cookies
  • Safari: Preferences → Privacy → Manage Website Data

7. Information for EU & California Users

  • EU / GDPR & ePrivacy: We comply with the GDPR and the ePrivacy Directive. Strictly necessary cookies (like auth-token) are set without prior consent as they are required for the service to function. Our cookieless analytics processing is based on our legitimate interest, and you have a right to object. All future non-essential cookies will require your explicit, opt-in consent.
  • California / CCPA/CPRA: We do not "sell" or "share" your personal information as defined by the CCPA/CPRA. If this practice ever changes, we will update this policy and provide the necessary opt-out mechanisms for California residents.

8. Changes to this Cookie Policy

We may update this policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we do, we will update the "Effective date" at the top of this policy.

9. Contact Us

If you have questions about our use of cookies, your right to object, or this policy, please contact us: https://www.glutenfreemap.es/contact

End of document