Cookie Policy
We use no ad pixels, no Google Analytics and no retargeting. We count visits without cookies: on the server, from a daily-rotating hash of the IP address and browser — nothing is stored in your browser for that. Below is the full list of what this site may store on your device, and why.
Version: 1.1 · 8.10.2026
Legal basis
Storage that is strictly necessary for the service or done at your request (language choice, admin session, payment, one-off animations) does not require consent — Art. 5(3) of the ePrivacy Directive and Art. 399(2) of the Polish Electronic Communications Law. Source and referral cookies appear only when you arrive from a tagged campaign or partner link, contain no personal data and can be deleted in your browser at any time. Stripe cookies appear only at payment.
Cookies and browser storage
| Name | Purpose | Lifetime | Party |
|---|---|---|---|
| NEXT_LOCALE | Remembered language (PL/EN) — only after you use the language switch | 1 year | SpotMade |
| spotmade-utm | Source of a visit from a tagged campaign link (utm_…), so we know which post a request came from — only after such a link | 30 days | SpotMade |
| spotmade-ref | Referral code from the affiliate programme (?ref=…), so the partner gets their commission — only after a partner link | 30 days | SpotMade |
| sm-splash, fs-cine, fs-exit | Flag that the intro animation or exit pop-up has already been shown this visit (sessionStorage, not a cookie) | until the tab is closed | SpotMade |
| authjs.session-token | Authenticated admin session | 30 days | SpotMade |
| authjs.csrf-token | CSRF protection at sign-in | session | SpotMade |
| authjs.callback-url | Magic-link return URL | session | SpotMade |
| sm_self | Admin’s own device only: excludes own visits from stats (localStorage, not a cookie) | until cleared | SpotMade |
| __stripe_mid, __stripe_sid | Stripe Checkout fraud prevention (only during payment) | 1 year / 30 min | Stripe |
Third parties
Payments: Stripe (stripe.com) — own cookie policy at https://stripe.com/cookies-policy/legal. Hosting: Vercel — no third-party cookies. Transactional email: Resend — no cookies (we do not use tracking pixels in emails). Videos and images are served from our own server, with no embedded YouTube or Instagram players.
How to manage cookies
You can delete all of the above in your browser’s privacy settings. The site works without them — you only lose the remembered language, and an admin would need to sign in again.
Contact
Cookie questions: contact@spotmade.com.