Cookie Policy

Last updated: October 22, 2026

1. Introduction

This Cookie Policy explains how HintCraft Spółka z o.o. ("we", "our", or "us") uses cookies and similar technologies on our website and application (collectively, the "Service").

We are committed to protecting your privacy and being transparent about the limited use of cookies on our platform.

Company Details:
HintCraft Spółka z o.o.
ul. Kazimierza Morawskiego 5/127, 30-102 Kraków, Poland
VAT EU: PL6762694168
Email: contact@hintcraft.com

2. What Are Cookies?

Cookies are small text files that are placed on your device (computer, smartphone, or tablet) when you visit a website. They help websites remember your preferences and improve your experience.

Cookies can be:

• Session cookies, temporary cookies that expire when you close your browser
• Persistent cookies, cookies that remain on your device for a set period or until you delete them

3. Our Privacy-First Approach

3.1 No Tracking or Marketing Cookies

We do NOT use:

• Advertising cookies
• Marketing or retargeting cookies
• Social media tracking pixels
• Cross-site tracking cookies
• Third-party analytics cookies that collect personal data

3.2 Cookieless Analytics

We use Plausible, self-hosted on our own server in the EU, to count visits: which pages are viewed, where visitors come from, and their country and device type. It sets no cookies, stores nothing in your browser, and does not store your IP address. We rely on our legitimate interest in understanding how the site is used; you can object by contacting us.

4. Essential Cookies and Storage We Use

We use a minimal number of strictly necessary cookies and browser storage entries required for the Service to function. These do not require consent under GDPR and the ePrivacy Directive.

4.1 Authentication

Purpose: Keep you securely logged in to your account
Provider: Auth.js, with Auth0 as the identity provider
Cookies:

• authjs.session-token, encrypted session token (up to ~30 days)
• authjs.csrf-token, CSRF protection (session)
• authjs.callback-url, post-login redirect (session)
• authjs.pkce.code_verifier (and, where used, authjs.state and authjs.nonce), sign-in security checks set only while you sign in (up to 15 minutes)

In production, the other cookie names carry the __Secure- prefix, except the CSRF cookie, which carries __Host- (__Host-authjs.csrf-token). The session token keeps its name.

These cookies contain encrypted identifiers and do not store personal information directly.

4.2 Payment Session

Purpose: Process secure payments and prevent fraud
Provider: Stripe
Cookies:

• __stripe_mid, fraud prevention device identifier (up to 1 year)
• __stripe_sid, fraud prevention session identifier (30 minutes)

Set by Stripe on the pages that load its payment form: checkout, and the AI usage page, where you can buy extra AI usage. Required for secure transaction processing.

4.3 Preferences

Purpose: Remember your language preference
Cookie: NEXT_LOCALE (1 year)

4.4 Session and App State (browser storage)

We also use a small amount of browser storage to preserve in-progress flows and remember your place in the app:

• hintcraft_storage, your display settings in the app, such as table columns, rows per page and filters (localStorage)
• hintcraft_payment_store, in-progress payment form state (localStorage)
• hintcraft_personality_test_store, your personality test progress (localStorage)
• listScroll:<path>?<query>, your scroll position in a list, so that going back returns you to the same place (sessionStorage)

5. Legal Basis for Cookie Use

Our use of essential cookies is based on:

• Legitimate interest (Article 6(1)(f) GDPR), necessary for website functionality and security
• Contractual necessity (Article 6(1)(b) GDPR), required to provide the Service you've requested

Since these cookies are strictly necessary, we do not need to obtain your consent before setting them.

6. Managing Cookies

6.1 Browser Settings

You can control and delete cookies through your browser settings:

• Chrome: Settings > Privacy and security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions

Important: Disabling essential cookies will prevent you from logging in and using core features of the Service.

6.2 Impact of Disabling Cookies

If you disable or delete our essential cookies:

• You will not be able to stay logged in
• Payment processing will not work
• Your language preference will not be saved
• Some features may not function correctly

7. Third-Party Services

While we minimize third-party dependencies, the following services may set cookies when you interact with specific features:

7.1 Stripe (Payment Processing)

When you make a payment, Stripe may set additional cookies for fraud prevention and payment processing. These are covered by Stripe's Cookie Policy.

7.2 External Links

Our Service may contain links to external websites. We are not responsible for the cookie practices of third-party websites. Please review their respective cookie policies.

8. Updates to This Policy

We may update this Cookie Policy to reflect:

• Changes in our cookie usage
• New legal requirements
• Improvements to our Service

When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email
• Post a notice on our website

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

9. International Users

9.1 European Economic Area (EEA)

We comply with GDPR and ePrivacy Directive requirements. Our use of essential cookies is lawful under these regulations without requiring consent.

9.2 United Kingdom

We comply with UK GDPR and PECR (Privacy and Electronic Communications Regulations).

9.3 California and Other US States

Our essential cookies are used for functionality purposes and are not subject to opt-out requirements under CCPA or similar state laws.

10. Your Rights

Under GDPR and other privacy laws, you have the right to:

• Access information about cookies stored on your device
• Delete cookies through your browser settings
• Object to processing where applicable
• File a complaint with your local data protection authority

For more information about your data rights, see our Privacy Policy.