Cookie policy

The important part, first

CityVibe uses no analytics, advertising or third-party cookies. None. There is no Google Analytics, no social network pixel and no audience measurement tool. That is why you will not see a cookie banner: we have nothing to ask you for.

The cookies we do use are the six in the list. All of them are first-party (set by cityvibe.guide and nobody else), and all of them are exempt from consent under article 22(2) of the LSSI (opens in a new tab): some are strictly necessary to provide the service and others store a preference you expressly asked for by pressing a button. This is the criterion of the AEPD's guide on the use of cookies (opens in a new tab).

None is set just because you visited. The preference ones are written at the exact moment you pick a language, pick a city or dismiss the language hint — never before.

The cookies, one by one

• __Host-ee_session

  What for

  Keeping you signed in. It is encrypted: inside it are your identifier, name, language, city and time zone, and only our server can open it.

  Lifetime

  30 days, renewed while you use the site

  Type

  Necessary

• __Host-ee_oauth_tx

  What for

  Holding the sign-in together while you go to Google or Telegram and come back (it protects against CSRF and against being returned to another site). It is deleted when you are done.

  Lifetime

  10 minutes

  Type

  Necessary

• NEXT_LOCALE

  What for

  Remembering the language you picked by hand, so we do not guess again.

  Lifetime

  1 year

  Type

  Preference you asked for

• CITY

  What for

  Remembering the city you picked by hand, so it is one tap away on every page. Nothing is inferred from your IP address.

  Lifetime

  1 year

  Type

  Preference you asked for

• locale_hint_off

  What for

  Remembering that you dismissed the “would you rather read this site in your language?” hint, so we do not repeat it.

  Lifetime

  6 months

  Type

  Preference you asked for

• eventos_admin

  What for

  The internal admin panel's session. Only team members signing in at “/admin” ever receive it.

  Lifetime

  8 hours

  Type

  Necessary (internal)

Technical detail, in case you care: the first two are “HttpOnly” (JavaScript cannot read them), “Secure” (HTTPS only) and carry the “__Host-” prefix, which stops a subdomain planting or overwriting them. “eventos_admin” is also “SameSite=Strict”. In local development the names drop the “__Host-” prefix, because browsers require HTTPS to accept it.

Inside Telegram (Mini App): the same cookies, with “SameSite=None” and “Partitioned” (CHIPS). That is what a browser demands so an app embedded in another page can keep its own session; the isolation CHIPS provides means that session cannot follow you outside Telegram.

Local storage (not a cookie, but we list it anyway)

• theme

  Where

  localStorage

  What for

  Remembering whether you prefer the light theme, the dark one or the system's.

  Lifetime

  Until you clear your browser data

We use no “sessionStorage”, no IndexedDB, no fingerprinting, no pixels and no service workers.

How to remove them

From your browser: Chrome (“Settings → Privacy and security → Cookies”), Firefox (“Settings → Privacy → Cookies and site data”), Safari (“Preferences → Privacy”), Edge (“Settings → Cookies and site permissions”).

Deleting “__Host-ee_session” signs you out. Deleting “NEXT_LOCALE” or “CITY” makes the site ask you again. Nothing else breaks: the whole catalogue works without a single cookie.

If we ever add analytics

Then there will be a banner, and it will work as it should: no pre-ticked boxes, “Reject” as visible as “Accept”, and not one measurement script loaded before you say yes. “By continuing to browse you accept” is not consent and we are not going to use it. We will update this page first, not afterwards.

Questions

Write to us at alexandr.shurigin@gmail.com (opens in a new tab). See also the Privacy policy.