Cookie and Local Storage Notice
Effective: 20 October 2026.
Avenler uses only cookies that are strictly necessary for providing the service. Under section 155(4) of Act C of 2003 on Electronic Communications (Eht.), placing such a cookie does not require the consent of the data subject; therefore we do not display a cookie consent banner; for your information, we list here what we store in the browser.
Cookies used
| Name | Purpose | Content | Lifetime | Legal basis |
|---|---|---|---|---|
elp_auth (over HTTPS: __Host-elp_auth) | Identifying the logged-in session | encrypted, signed session ticket (not readable in the browser: HttpOnly; sent only from the same site: SameSite=Lax; over HTTPS Secure) | without “Keep me logged in”: until the browser is closed; when ticked: no more than 30 days, extended with use | the Operator's legitimate interest and performance of a contract (Article 6(1)(b) and (f) GDPR); a strictly necessary cookie under section 155(4) of the Eht. |
__cf_bm (set by Cloudflare when bot filtering is switched on) | telling bot traffic apart from real visitors | technical data needed for Cloudflare's bot filtering; not read by the Service | expires after 30 minutes of inactivity | the Operator's legitimate interest (Article 6(1)(f) GDPR): protecting the Service; a strictly necessary cookie under section 155(4) of the Eht. |
cf_clearance (set by Cloudflare only when it has asked for a security check) | proving that your browser has passed Cloudflare's security check | technical data proving the check was passed; not read by the Service | for the period set by Cloudflare | the Operator's legitimate interest (Article 6(1)(f) GDPR): protecting the Service; a strictly necessary cookie under section 155(4) of the Eht. |
What we do not use
- there are no analytics or marketing cookies, tracking pixels or social media plug-ins; the anonymous visitor statistics (see the Privacy Notice) do not use cookies or an identifier stored in the browser either;
- no content is loaded from external providers (font provider, maps, advertising, etc.): your browser communicates only with the Operator's server while you use the site, through Cloudflare's protection network (see section 3 of the Privacy Notice);
- the browser's local storage is used only for the purposes listed in the “Local storage” section below, and never for tracking.
Local storage in the browser
The browser's local storage is not a cookie and is not sent to the server with your requests; its content stays on your device and the Operator has no access to it. The application uses the following, solely to operate the service:
| Storage | Purpose | Content | Lifetime | Legal basis |
|---|---|---|---|---|
| IndexedDB (a separate database per account) | offline use of Site mode: the downloaded project and the changes recorded without a network that have not been sent yet | the data of the project's site view (drawing, devices, issues, photos) and the pending changes | until you log out; at most 30 days, or until you download again; deleted on logout | performance of a contract (Article 6(1)(b) GDPR): providing the requested service; strictly necessary storage under section 155(4) of the Eht. |
| Cache Storage and service worker | storing the application's files so that the downloaded project also opens without a network | the application's program files (not personal data) | until a new program version, then overwritten | the Operator's legitimate interest and performance of a contract (Article 6(1)(b) and (f) GDPR); strictly necessary storage under section 155(4) of the Eht. |
localStorage | offline sign-in: the ID, e-mail address and admin flag of the most recently signed-in user | three fields; no password or session ticket | until you log out | performance of a contract (Article 6(1)(b) GDPR); strictly necessary storage under section 155(4) of the Eht. |
localStorage (for a large drawing, the account's IndexedDB) | keeping an unsaved drawing: if saving does not succeed (network, conflict, closed tab), it can be restored the next time the editor opens | the level's unsaved drawing and the server version it is based on | until the next successful save, the Discard button or logging out | performance of a contract (Article 6(1)(b) GDPR); strictly necessary storage under section 155(4) of the Eht. |
localStorage | convenience settings: interface language, button hints, view and print settings, clipboard, light/dark theme | setting values; no personal data | until you delete them | providing the service you requested (Article 6(1)(b) GDPR); strictly necessary storage under section 155(4) of the Eht. |
sessionStorage | remembering the “Later” choice at the What’s New newsletter prompt | a flag | until the browser tab is closed | the Operator's legitimate interest (Article 6(1)(f) GDPR) |
You can delete the site's data in your browser settings at any time; the downloaded offline project and any unsent changes are then lost too.
How can you delete the cookie?
Logging out (Log out button) deletes the session cookie. You can delete or block cookies at any time in your browser settings; in that case logging in will not work.
Changes
If in the future we introduce a cookie that is not strictly necessary (e.g. an advertising or tracking cookie), we will do so only on the basis of your prior, explicit consent, and we will amend this notice beforehand.
Questions: [email protected]. The processing of data as a whole is covered by the Privacy Notice.