1. What cookies and local storage are
Cookies are small pieces of information stored by a browser on the user's device. The service may also use the browser's local storage. These mechanisms maintain sessions, protect forms and remember a selected setting.
2. Mechanisms currently used
- session cookie — maintains the session and sign-in; essential for the account;
- form-protection token — protects against unauthorised requests made on the user's behalf;
km-themein local storage — remembers the selected website colour theme;km-analytics-consentin local storage — remembers consent or refusal so the question is not repeated on every page;km-ga-purchasesin local storage — after consent, remembers a limited list of anonymous purchase identifiers already sent, so refreshing the page does not duplicate the event.- Android app storage
kilometrowka_install_attribution— after installation from Google Play, stores the type and value of an ad click identifier and collection time; the data remain local for up to 90 days and are used only after the user opens the registration form.
Session and form-protection mechanisms are necessary to provide the requested service and ensure security. Remembering the theme serves a feature expressly selected by the user. These mechanisms do not require separate consent because they fall within the exception for data necessary to deliver the requested service. We do not use them for advertising or cross-site tracking.
3. Google Analytics
After voluntary consent, the public website and the registration email-confirmation screen start Google Analytics 4 with measurement ID G-0X2TXZVZ3R. It helps measure visits, referral sources, devices, navigation on public pages and sales stages: viewing prices, selecting a plan, starting checkout, activating a trial after email confirmation and a confirmed purchase. Trial activation and purchase events may be imported into Google Ads to measure campaign effectiveness. For purchases, we send the plan and cycle name, net amount, VAT, PLN and an anonymous transaction identifier. We do not send names, email addresses, NIP numbers, pro forma numbers, form contents, trips or GPS points to Analytics.
If the visit started from a Google Ads advert, the server-side session may also hold the click identifier from the page address so that the source can be recorded when an account is created. We do not create additional cookies for this and do not send the identifier to Google.
Google Analytics may set _ga and _ga_* cookies, normally for up to 2 years, to distinguish users and maintain session state. Google signals and ad personalisation are disabled in the website code. Consent can be changed at any time using “Privacy settings” in the footer; after withdrawal, the tag will not load on subsequent page views. Existing cookies can be deleted in browser settings.
4. Other external services
The Features page and the Android app article embed YouTube videos in privacy-enhanced mode from youtube-nocookie.com. The player on the main Features page loads with the page and attempts to start the video automatically with sound muted; the player in the article is lazy-loaded and does not start automatically. Loading either player creates a direct connection between the browser and Google/YouTube and may involve the IP address, device and browser information, the visited page address and interactions with the player. Privacy-enhanced mode limits the use of playback for personalisation, but it does not eliminate the transmission of technical data. If external YouTube resources are blocked in the browser, the embedded video will not be displayed; a standard link to YouTube remains available.
Google reCAPTCHA loads only on the registration page to distinguish humans from bots. It may use Google cookies or device storage and analyse technical information and interactions. This mechanism is necessary to protect the public form; we do not use it for advertising. Details are set out in Google's privacy policy and terms.
Google sign-in and ad personalisation on the service are not enabled. The service may be advertised through Google Ads, while conversion measurement is performed through the consent-based Analytics events described above. Viewing the payment page alone does not connect the browser to Paynow; a connection to the operator's service is made only after selecting the online payment button. On the Paynow website, the operator may use its own essential mechanisms under its privacy notice.
5. Maps
A map loads only on the specific trip page available to an administrator. Its content comes from Geoapify, an external mapping service using OpenStreetMap data. Technical requests are not the same as the commercial “map opening” described in the price list. Billing for logical openings is not yet active.
6. Managing device data
Cookies and local storage can be deleted in browser settings. Blocking essential cookies may prevent sign-in, registration, checkout or secure form submission. Deleting km-theme restores the default colour theme. Install Referrer data are removed when Android app data are cleared or the app is uninstalled; after 90 days, the app stops using the stored identifier.
7. Changes
If further mechanisms not required for the service are introduced, users will receive appropriate information and an opportunity to decide before they are stored or accessed, where required by law.
Legal basis: Article 399 of the Polish Electronic Communications Law of 12 July 2024. Information about personal data processing is provided in “Privacy and GDPR”.