Draft — to be reviewed by a lawyer. Draft v0.2, 2026-10-23. This text is not yet binding and is not legal advice.
The company has not been registered yet, so the controller and provider data fields are intentionally empty. Company details will be added once the company (sp. z o.o.) is registered
Cookie Policy
Draft v0.2, 2026-10-23
1. In short
The Enigma LABZ website sets no tracking cookies and uses no advertising tools. Our own page-view statistics, which use no cookies, run only after you consent (section 4). The only things we store in your browser are the few technical entries listed below, each either strictly necessary or something you asked for.
2. Legal basis
Storing or accessing information on your device needs your consent unless it is strictly necessary to provide a service you explicitly requested (Article 5(3) of the ePrivacy Directive 2002/58/EC; Article 399 of the Polish Electronic Communications Law). Every entry in section 3 falls under that exemption. The rule covers localStorage and sessionStorage as well as cookies.
3. What we store
| Name and location | Purpose | Duration | Basis |
|---|---|---|---|
theme — localStorage | remembers light or dark theme; written only after you click the theme toggle | until you clear site data or change it again | requested by you — strictly necessary |
consent — localStorage | records your choice in the consent banner (version, analytics yes/no, date) | until you clear site data or the banner version changes | strictly necessary to respect your choice |
authjs.session-token — cookie (HttpOnly, __Secure- prefix on https) once accounts launch | keeps you signed in to your Account; set only after you sign in | 30 days or until you sign out | requested by you — strictly necessary |
authjs.csrf-token, authjs.callback-url, authjs.state, authjs.pkce.code_verifier, authjs.nonce — cookies once accounts launch | protect the sign-in form against CSRF, secure sign-in with Google, GitHub or Hugging Face, and return you to the right page | until you close the browser; provider sign-in cookies — 15 minutes | requested by you — strictly necessary |
onboarding — sessionStorage once accounts launch | the signed-in Account name shown under the “Check your hardware” steps | until you close the browser tab | requested by you — strictly necessary |
ruch.pomin — localStorage | turns off counting your own visits in the statistics; written only when you open a page with ?nieliczmnie while statistics are on | until you clear site data or open a page with ?licztez | requested by you — strictly necessary |
Sign-in cookies go only to our own server, so it can recognise your Account. No other entry is ever sent to our server or to third parties.
4. The “analytics” category
The consent banner includes an “analytics” category. Only after you click “Accept” does the site load our own page-view statistics (the /ruch.js script, sending data to our server at enigmalabz.com). They use no cookies and no third-party tools, and the data is not passed on beyond our hosting server. For each page view we record the page address and title, the referring domain or campaign tag, screen width, browser language, device type, browser, operating system and time spent on the page. We do not store your IP address: a visitor is recognised only within one day, by a hash of the IP address and browser mixed with a random daily salt that is deleted after two days. Without consent nothing loads; after you withdraw consent the script stops sending data.
5. Changing your mind
Every page has a “Cookie settings” link in the footer. It reopens the consent banner, where you can change or withdraw your choice; rejecting is as easy as accepting. You can also clear the site’s data in your browser settings at any time, and the banner will appear again.
For everything else about personal data, see the Privacy Policy.