Cookie & data privacy
How we use cookies and similar technologies, and the legal basis for each.
We minimize the data we keep about you. This page lists every cookie, localStorage and sessionStorage entry that may exist on your device when you use EvoMap, what it is for, how long it lasts, and the legal basis for processing it. You can review or change your choice at any time via the 'Cookie preferences' link in any page footer.
Strictly necessary
These items are required for the site to function. They are written regardless of your cookie banner choice; refusing them would break login, security, anti-abuse, or first-party performance analytics.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| evomap_sid | Cookie | Login session token | 30 days (Max-Age in src/lib/cookie.js) | GDPR Art. 6(1)(b) — contract performance |
| evomap_user | localStorage | User profile cache (reduces /me request frequency) | Persistent (cleared on logout) | Art. 6(1)(b) |
| evomap_auth_ts | localStorage | 401 grace-period timestamp (prevents short-network-blip logout) | Persistent | Art. 6(1)(b) |
| evomap_chunk_reload | sessionStorage | Auto-recovery from post-deploy chunk-load errors | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (deployment stability) |
| evomap_ai_chat_quota | localStorage | Anti-abuse rate limit for the AI chat surface | Persistent | Art. 6(1)(f) — anti-abuse |
| evomap_storage_warned | sessionStorage | Storage-error telemetry dedupe (≤ 1 warn per 24h per tab) | 24h cooldown; cleared on tab close | Art. 6(1)(f) |
| evomap_consent | localStorage | Your cookie-preference decision (so we don't re-ask every visit) | 90 days | GDPR Art. 7 — consent record |
| evomap_consent_expired | localStorage | Single-shot marker so we know to re-prompt after TTL expiry | Short-lived (cleared on next banner mount) | Art. 7 |
| evomap_anon_id | localStorage | First-party anonymous identifier — site performance improvement only, never shared with third parties | Persistent | Art. 6(1)(f) — first-party analytics (ICO / AEPD position) |
| evomap_session_id | sessionStorage | First-party session identifier — rotates every 30 min of inactivity | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_session_ts | sessionStorage | Last-activity timestamp paired with evomap_session_id (drives idle rotation) | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_utm | sessionStorage | Marketing-campaign entry attribution — current session only | Session (cleared on tab close) | Art. 6(1)(f) |
| evomap_pending_credit_purchase | sessionStorage | Temporary checkout-return context for credit top-ups: selected credit amount, USD amount, and Hub order id. It never stores card numbers, payment tokens, or provider secrets. | Session; removed after the credit-purchase result return is processed | Art. 6(1)(f) — payment attribution and support diagnostics |
Functional
Items that store user preferences you actively chose (language, theme, AI chat history).
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| evomap_locale | Cookie + localStorage | Your selected language | 1 year | Art. 6(1)(a) — user-initiated preference |
| evomap_theme | Cookie + localStorage | Your selected theme | 1 year | Art. 6(1)(a) |
| evomap_ai_chat | localStorage | AI chat history (local only — never uploaded) | Persistent | Art. 6(1)(b) — user-generated content |
| evomap_onboarding | localStorage | Onboarding-tour completion state | Persistent | Art. 6(1)(f) |
Analytics (third-party — togglable)
Google Analytics 4 cookies. Default-denied in strict regions (EU/EEA/UK/Switzerland, EU microstates, UK Crown Dependencies, Brazil, South Korea, Japan, Türkiye, Israel — plus any visitor whose country cannot be resolved); default-granted elsewhere with no banner shown. Strict-region visitors toggle via the cookie banner; other visitors can open the panel via the 'Cookie preferences' link in the footer. We also store an irreversible hash of the email address you enter at registration in our own first-party database for conversion-funnel analysis; this hash is never shared with Google.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| _ga | Cookie (Google SDK, written on our domain) | Google Analytics 4 visitor identifier | 2 years | Art. 6(1)(a) — explicit consent (banner) |
| _ga_<id> | Cookie (Google SDK, written on our domain) | Google Analytics 4 property-scoped session | 2 years | Art. 6(1)(a) |
| _gid | Cookie (Google SDK, written on our domain) | Google Analytics 4 short-term visitor distinguisher | 24h | Art. 6(1)(a) |
| analytics_event_email_hash | Server-side database field (evomap_behavior_events.properties.email_sha256 — irreversible SHA-256 hash) | Irreversible hash of the email entered at registration intent / completion (register_button_click, register_create_account_result) for conversion-funnel analysis. Stored only in our first-party database; the plaintext email is never persisted to analytics and never forwarded to Google. | Retained until account deletion; deletable on request | Art. 6(1)(f) — legitimate interest (product analytics) |
Advertising (third-party — togglable)
Google Ads conversion-tracking cookies. Same default policy as analytics, split into three Google Consent Mode v2 axes (ad_storage, ad_user_data, ad_personalization) you can toggle independently.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| _gcl_aw | Cookie (Google Ads SDK) | Google Ads conversion attribution | 90 days | Art. 6(1)(a) |
| _gcl_au | Cookie (Google Ads SDK) | Google Ads conversion linking | 90 days | Art. 6(1)(a) |
| _gcl_dc | Cookie (Google Ads SDK) | Google Ads display network | 90 days | Art. 6(1)(a) |
Your rights
Under GDPR you can withdraw consent at any time, request a copy of your data, request deletion, and complain to a supervisory authority. Email contact@evomap.ai for any data request.
Contact
Operator: EVOMAP PTE. LTD. General questions and data requests: contact@evomap.ai.