Cookie policy
Last updated: 6 November 2026
1. In short
- Nothing non-essential runs before you choose. Reject is as prominent as Accept.
- Our own statistics (Umami, self-hosted) use no cookies and write nothing to your browser. They are not sent if your browser has Do Not Track on.
- Google Analytics 4 loads nothing and sets no cookies until you click Accept.
- We use no advertising or tracking cookies. Ad storage, ad user data and ad personalisation are always denied, and Google Signals is off.
2. What is stored on your device
| Name | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
| klawsfx_cookie_consent | klawsfx.com (browser localStorage, not a cookie) | Remembers your cookie choice and when you made it. It is not sent to us. | 12 months, then we ask again | Strictly necessary |
| _ga | Google Analytics, first party, only after consent | Distinguishes users | 2 years | Analytics (consent) |
| _ga_<container-id> | Google Analytics, first party, only after consent | Keeps session state | 2 years | Analytics (consent) |
| __cf_bm | Cloudflare (our security and anti-bot proxy) | Tells humans from bots so the site stays available and protected. May be set on any page. | 30 minutes | Strictly necessary |
| cf_clearance | Cloudflare (our security and anti-bot proxy) | Set only after your browser passes a Cloudflare security check, so the check is not shown again. Not used for advertising or tracking. | Until the check expires (usually a few hours) | Strictly necessary |
| NEXT_LOCALE | klawsfx.com | Remembers the language you chose. Set when you open a Greek page or switch language. | 1 year | Strictly necessary |
| admin_session | klawsfx.com, only when the site owner logs in to the admin area | Keeps the owner signed in (HttpOnly, SameSite Lax). Visitors never receive it. | 7 days | Strictly necessary |
Cloudflare Turnstile (bot check) appears only on forms that issue keys or send email. We set no cookie for it; Cloudflare may use technical data from your browser to tell humans from bots, as described in its own policy. Stripe checkout happens on Stripe's own page, under Stripe's policies. The site loads its fonts from our own server.
3. Cookieless statistics (Umami)
We run Umami (open source) on our own server at stats.klawsfx.com. Per page view it records the page path (without query strings), page title, referring site, browser, operating system, device type, screen size, language, country and events such as button clicks. Your IP address is not stored. A visit identifier is a one-way hash of IP, user agent, website and a secret salt that rotates periodically, so visits are counted without identifying you or following you across days or sites. Legal basis: Art. 6(1)(f) GDPR. No consent is needed because nothing is stored on or read from your device for tracking. To object, turn on Do Not Track in your browser or write to contact@klawsfx.com.
4. Google Analytics 4 (only with consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may go to Google LLC (USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses. Consent Mode starts at "denied" and only analytics storage is granted when you accept. GA4 does not log or store IP addresses of EU users. In our properties event-level data is kept for 2 months and user-level data for 14 months. Legal basis: Art. 6(1)(a) consent.
5. Change or withdraw your choice
Use (also in the footer of every page). It reopens the banner; Google Analytics stops and the _ga cookies are deleted. You can also delete cookies and site data in your browser. More about how we handle personal data: Privacy policy.