Cookie policy

1. Short version

No advertising cookies, no analytics cookies, no tracking pixels and no third-party trackers.
The only cookies we set keep business users logged in and the login form secure.
Customers who open a review link get no cookies at all.
We never use cookies to build profiles or to follow you to other websites.

2. What cookies and local storage are

A cookie is a small text file a website stores in your browser and reads back on later visits. Local storage is a similar browser feature that keeps small settings on your device. Unlike cookies, local storage is not sent to our servers automatically.

Both are covered by the Latvian Law on Information Society Services (Informācijas sabiedrības pakalpojumu likums, Section 7.1) and the EU ePrivacy Directive, which allow storage that is strictly necessary to provide a service the user has asked for without consent.

3. Cookies we set

These are set only when you log in to the Bifre dashboard, and all are first-party (set by our own domain).

Name	Purpose	Duration	Type
`authjs.session-token`	Keeps you logged in. Contains an encrypted, signed session with your user id; it cannot be read by scripts on the page.	Up to 30 days, renewed while you use the dashboard	Strictly necessary
`authjs.csrf-token`	Protects the login form against cross-site request forgery.	Until the browser is closed	Strictly necessary
`authjs.callback-url`	Remembers which page to return to after logging in.	Until the browser is closed	Strictly necessary
`active_business`	Remembers which of your locations you last opened in the dashboard.	1 year	Strictly necessary (functional)

On the live site, login cookies may carry a __Secure- or __Host- prefix. This tells the browser to send them only over HTTPS. All of them are marked HttpOnly and SameSite=Lax.

4. Local storage

These settings stay on your device and are never sent to us automatically.

Key	Purpose	Where	Duration
`dashboard_lang`	The language you chose for the dashboard, login and sign-up pages.	Dashboard	Until you clear it
`qr_waiter`	Which team member uses this phone, so they don’t have to pick their name each time.	Staff screen	Until you clear it
`qr_ui_lang`	The language of the staff screen.	Staff screen	Until you clear it

5. Customer review pages

The page a customer opens from a review link or QR code sets no cookies and uses no local storage. It does not identify the customer, and nothing is saved on their device. The customer’s choices are sent to our server only to generate the draft, as described in the privacy policy.

6. Third parties

We do not embed advertising, social media widgets, analytics scripts or tracking pixels.
Fonts are bundled with our site and served from our own domain, so your browser does not contact Google Fonts when you visit.
Our hosting provider, Vercel, may process technical data such as your IP address to deliver the page and protect it against attacks. It does not set tracking cookies on our site.
When a customer taps the button to open Google and post their review, they leave our site. Google’s own cookie and privacy policies then apply.

8. Managing and deleting

You can view and delete cookies and local storage at any time in your browser:

Chrome: Settings → Privacy and security → Third-party cookies / See all site data and permissions.
Safari (Mac and iPhone): Settings → Safari → Advanced → Website Data.
Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data.
Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.

Logging out removes the session cookie. If you block our cookies, you can still read the website and customers can still use review links, but you will not be able to log in to the dashboard.

9. Changes and contact

We update this page whenever we add, change or remove a cookie or storage item. The date at the top shows the latest version. Contact: Artjoms Lupjaks, Riga, Latvia. Email: hello@bifre.com.