Cookie & Local-Storage Policy
This policy explains which cookies and similar browser storage Aphilly uses, what each one does, and how you control them. It applies to aphilly.com and is part of our Privacy Policy. The data controller is Riddle OÜ (registry code 17254064), Estonia — info@riddle.ee.
1. The two categories we use
Strictly necessary cookies are required to deliver the service you asked for — signing you in and protecting the sign-in form. Under EU law (ePrivacy Directive Art. 5(3)) these do not require your consent, and you cannot switch them off while using an account.
Analytics cookies are optional. They are set only if you press “Accept analytics” on our cookie banner. Until you do — and if you reject, or simply never answer — no analytics cookies are set and no analytics script is loaded at all. Your legal basis for these is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.
We do not use advertising, ad-targeting, profiling, or cross-site tracking cookies, and we do not sell or share your data with advertisers.
2. Strictly necessary (no consent required)
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
next-auth.session-token | Cookie (first-party, HttpOnly) | Aphilly | Keeps you signed in to your account | Up to 30 days |
next-auth.csrf-token | Cookie (first-party, HttpOnly) | Aphilly | Protects the sign-in flow against cross-site request forgery | Session |
next-auth.callback-url | Cookie (first-party) | Aphilly | Returns you to the right page after signing in | Session |
aphilly_cookie_consent | localStorage | Aphilly | Stores your cookie choice (accepted / rejected) and when you made it, so we can honour it and evidence it. Necessary in order to respect your own preference. | Until you clear it or change your choice |
3. Functional (first-party, no advertising, no consent required)
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
aam_ref | localStorage | Aphilly | Remembers a referral code you arrived with (?ref=) so the person who referred you can be credited if you sign up. First-party only; never read by any third party and never used for cross-site tracking or advertising. | Until you clear it |
4. Analytics — optional, off until you accept
If you accept, we load Google Analytics 4 (provided by Google Ireland Limited) to see aggregate, statistical information about how the site is used — which pages are visited, roughly where visitors come from, and which features get used — so we can improve the product. We do not use it for advertising, remarketing, or ad personalisation, and Google Signals / ad features are not enabled. IP addresses are anonymised.
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
_ga | Cookie (third-party, set via script on our domain) | Distinguishes one visitor from another for usage statistics | Up to 2 years | |
_ga_<stream id> | Cookie (third-party, set via script on our domain) | Keeps session state for our specific Analytics property | Up to 2 years |
International transfers. Using Google Analytics can involve your data being processed in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and we rely on that adequacy decision together with Google’s Standard Contractual Clauses as the transfer mechanism (GDPR Ch. V). See §4 of our Privacy Policy for how we handle transfers generally. Google’s own explanation of this data is at policies.google.com/technologies/partner-sites.
If you reject analytics, no request is ever made to Google’s servers from our pages and no such transfer takes place.
5. What happens when you reject
- The Google Analytics script is not loaded — we block it before it runs, rather than loading it and asking it to behave.
- No
_gaor_ga_*cookie is created. - If you previously accepted and then withdraw, we delete the existing
_gaand_ga_*cookies from your browser. - Everything else on the site keeps working normally. Rejecting costs you no features and no content — there is no cookie wall.
- We will not re-ask you unless the cookies we use actually change, or you clear your browser storage.
Not answering the banner has exactly the same effect as rejecting: analytics stays off until you actively accept.
6. Changing your choice
You can change or withdraw your consent at any time, as easily as you gave it — press the button below, or the “Cookie settings” link in the site footer, and the banner will reappear.
You can also clear cookies and local storage in your browser settings at any time. Clearing aam_ref simply means a past referral will not be attributed; clearing the session cookie signs you out; clearing aphilly_cookie_consent means we will ask for your cookie choice again.
7. Your rights
You have the right to access, correct, delete, and port your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority — for us, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Our Privacy Policy explains each right and how to exercise it. Withdrawing cookie consent does not affect the lawfulness of processing carried out before you withdrew it.
8. Changes to this policy
If we add, remove, or change the purpose of any cookie, we will update this page and ask for your consent again where the law requires it. The date at the top shows the current version.