Cookie Policy

This Cookie Policy explains how parat.io uses cookies and similar technologies (local storage, IndexedDB, session storage) on parat.io and in the race planner at parat.io/raceplanner. For the broader picture of how we handle personal data, see the Privacy Policy.

Storing or reading information on your device requires your prior consent unless the storage is strictly necessary to deliver the service you explicitly requested (§25 TTDSG, implementing the ePrivacy Directive). Analytics, marketing, and most personalisation do not count as strictly necessary. Rejecting non-essential storage must be just as easy as accepting.

• firebase:authUser:* (IndexedDB — or sessionStorage if you don’t select “Remember me” when signing in) — keeps you logged in. Until you sign out — or, without “Remember me”, until you close your browser.
• firebase-installations-database (IndexedDB) — abuse prevention / rate limiting.
• firebase-heartbeat-database (IndexedDB) — SDK health telemetry (no personal data).
• Firestore offline cache (IndexedDB, capped at 40 MB) — lets your saved events keep rendering when you’re offline. Managed by the Firestore SDK; not time-boxed by our code.
• Service Worker Cache Storage (parat-precache, parat-static, parat-runtime, parat-tiles) — caches the app shell, static assets, and map tiles so the installed app works offline. Registered in production only. Kept until an app update bumps the cache version and evicts the previous one.
• parat:hasSession (localStorage) — remembers, for the instant before Firebase re-confirms it on each load, that you were signed in last time, so the app can skip flashing the logged-out landing page before redirecting you to your dashboard. Not itself a security check. Until you sign out.
• parat:pwa:installDismissedAt (localStorage) — remembers that you dismissed the “Install parat.io” prompt, so we don’t show it again for 30 days.
• NEXT_LOCALE (cookie) — remembers your UI language (de / en / fr). For your browser session (cleared when you close your browser).
• parat_consent (cookie) — does not exist today. There is currently no consent banner and no non-essential storage for it to record a choice about. See Section 6.
• rp_session (cookie, race planner) — your Suunto sign-in, stored as encrypted and signed OAuth tokens (HttpOnly, Secure, scoped to /raceplanner). Set only after you connect your Suunto account; there is no server-side copy — the cookie is the session. Up to 180 days, or until “Sign out & delete all data”.
• rp_oauth (cookie, race planner) — CSRF protection during the Suunto sign-in round trip. 10 minutes.
• current-race, current-gpx (IndexedDB, race planner) — your race plan and GPX track. Stored in your browser only; until you clear them via “Clear all Track Data”.
• sample-seeded (IndexedDB, race planner) — a flag recording that the example race has already been loaded into the planner, so “Clear all Track Data” is an actual delete instead of the demo reappearing on your next visit. Set on your first visit to the planner, before any action you take there. It is intentionally not removed by “Clear all Track Data” — that button must leave an empty planner, not respawn the demo — and nothing else removes it automatically either; it only goes away if you clear this site’s data in your browser settings.

No cookies or device storage in this category. We measure page views with Vercel Web Analytics, which is cookieless — it sets nothing on your device and is described in Section 5 and in the Privacy Policy. We do not run Google Analytics, Plausible, PostHog, Meta Pixel, or any comparable tool. Any future tool that stores or reads information on your device will be listed here and will require your consent through a cookie banner before being loaded.

Vercel Web Analytics (same-origin): page views are counted by a script and a beacon served from parat.io itself and processed by our hosting provider Vercel. It sets no cookie and stores nothing on your device; Vercel derives a per-day visitor hash from IP address and browser signature. Legal basis and how to object: Privacy Policy, section 3.

Even without setting cookies, the browser makes requests to third-party services while using parat.io. Each transmits your IP and User-Agent to the receiver:

• api.maptiler.com — Leaflet map tiles (MapTiler AG, Switzerland).
• nominatim.openstreetmap.org — geocoding fallback.
• maps.googleapis.com — optional geocoding, called server-side.
• *.firebaseapp.com, *.firebasestorage.app, firestore.googleapis.com — authentication, database, file storage.
• cloudapi.suunto.com — race planner only: route upload and account connection, and only after you connect your Suunto account.

Everything listed in Section 3 serves a function you (or, for the race planner, the visitor) explicitly requested — staying signed in, keeping your chosen language, rendering the app offline, connecting your Suunto account. (The one exception is the race planner’s own example-race flag, which is written on first visit before you’ve done anything — it exists solely to make the planner’s own “Clear all Track Data” control behave correctly, not for analytics or marketing.) None of it is analytics, marketing, or personalisation, which is why no consent banner is in place today.

If that ever changes — i.e. before we ship anything that is not strictly necessary — a consent banner will be added first, with these commitments:

• A banner appears on your first visit.
• Equal-weight buttons for “Accept all” and “Reject all”.
• A “Preferences” pane to accept or reject each category individually.
• Your choice is saved in a parat_consent cookie.
• The banner is re-openable from the footer link “Cookie preferences”.
• You can withdraw consent at any time; withdrawal takes effect immediately.

Nothing in Section 3 is analytics, marketing, or personalisation — each item is either a function you asked for or, in the single case described in Section 6, needed for the race planner’s own delete control to work. Our cookieless reach measurement (Section 5) stores nothing on your device either. So there is nothing for a Global Privacy Control (GPC) signal or a Do Not Track (DNT) header to reject, and we don’t read either signal today; you can object to the reach measurement by email (Privacy Policy, section 3). If we ever introduce non-essential storage, we will honour GPC as a rejection of it at that time.

Questions about cookies or tracking? Email hello@parat.io.