Cookie Policy

⚠️ DRAFT — not legal advice. Generated from a code audit and not reviewed by
a lawyer. Items marked [FILL IN] must be completed before this is relied on.

Last updated: [FILL IN: date of publication]

This site is deliberately light on cookies. We run no analytics, no advertising,
and no visitor tracking — no Google Analytics, no Meta Pixel, no Hotjar, no tag
manager.

How your choice is handled

Cookie consent on this site is managed by bara-cookie, a self-hosted consent
manager operated by BARADATA. When you first visit, non-essential items are
blocked until you choose — nothing optional loads while the banner is waiting
for an answer, and rejecting is exactly as easy as accepting.

Your decision is stored in a __bara_consent cookie (and mirrored to local
storage) for 180 days, and recorded server-side as an audit trail.

You can change or withdraw your choice at any time via "Cookie settings" in the
footer of every page.

Category	What it covers	Can you refuse it?
Necessary	Security, sign-in for site administrators, and remembering your cookie choice	No — the site cannot work without these
Preferences	Remembered settings. Currently unused.	Yes
Analytics	Traffic measurement. Currently unused — we run none.	Yes
Marketing	Third-party embeds that can profile you across sites — currently only the Google Map	Yes

Cookies and storage we set

Name	Type	Provider	Purpose	Category	Duration
`__bara_consent`	Cookie + local storage	BARADATA (bara-cookie)	Remembers your cookie choice	Necessary	180 days
`__session`	Cookie (httpOnly)	Surfface	Keeps a site administrator signed in. Never set for ordinary visitors.	Necessary	5 days
`surfface-cart`	Local storage	Surfface	Remembers items in your shopping cart. Not active — the shop is currently disabled.	Necessary (for the shop)	Until cleared

Third-party content

Provider	Where	What loads	Category	When
Google Maps	Contact page	Interactive map of our location; Google sets its own cookies	Marketing	Only after you allow marketing cookies. Until then the map is replaced by a placeholder and nothing is requested from Google.
Stripe	Checkout	Payment processing and fraud prevention	Necessary to complete a purchase	Only during checkout — currently unreachable, the shop is disabled

The homepage background video is self-hosted and sets no third-party cookies.

Controlling cookies

Use "Cookie settings" in the footer to change or withdraw consent at any time.
You can also delete cookies and local storage through your browser settings.
Blocking __session affects only administrator login, not ordinary browsing.

Changes

We will update this page if our use of cookies changes. See also our
Privacy Policy.

Assumptions & open questions