Cookie Policy

Throughplan is provided by GRIIND s. r. o., Mierová 1099/66, 064 01 Stará Ľubovňa, Slovakia, company ID 53 821 173, VAT ID SK2121505331, registered in the Commercial Register of the District Court Prešov, section Sro, file no. 42298/P. That company is responsible for the cookies and storage described here.

Throughplan uses as little browser storage as it can. Without your consent it sets nothing beyond what running the site and signing in require, and loads nothing from anyone else. The one optional purpose you are asked about is analytics, and Google Tag Manager, which loads Google Analytics and is described in its own section below, is loaded only if you allow it. Error reports are sent by default so we can fix what breaks, and you can switch them off. This policy lists everything Throughplan stores in your browser or desktop app, and why.

These cookies are essential (the “Necessary” category in the cookie settings), so they are set without asking. Without them you cannot sign in.

• Session cookie (better-auth.session_token; on our live site the name starts with __Secure-). Keeps you signed in, in the browser and in the desktop app. Set when you sign in; valid for 7 days and renewed while you use the product; removed when you sign out. It is signed, cannot be read by page scripts, and is sent only over HTTPS to our own site.
• Account cookies (better-auth.device_account_ followed by an identifier; on our live site the name starts with __Host-): one for each account you are signed in to on this device, up to five. They let you switch between your accounts without signing in again. Each is set when you sign in to that account, is valid for 7 days from then or from the last time you switched to it, and is removed when you sign that account out or sign out of all accounts. They are signed, cannot be read by page scripts, and are sent only over HTTPS to our own site.
• Sign-in state cookie (better-auth.state). Only while you sign in with Google, to check that the answer coming back from Google belongs to the sign-in you started. It expires after 5 minutes.

The apps keep a few settings in local storage, and one note in the session storage of a browser tab, under names starting with “throughplan.”. They stay on your device and are never used to track you:

• your language and your light or dark theme;
• your cookie choices, with the version of this text they answered and when you made them, so the banner does not ask again for 6 months;
• if you switched error reports off, that you did and when, so they stay off;
• which release notes you have seen, and whether you finished the introductory tour;
• how you like the project list shown (grid or list) and your email notification preference;
• whether someone was signed in on this device when the site last checked (only that fact, never who) so our home page can open the app straight away;
• for as long as a tab is open, in its session storage: when it last reloaded itself onto a new release of the app, so that it does not reload in a loop;
• in the desktop app: the project you have open, your canvas display options, and which AI tool the engine uses (kept in a settings file in the app’s data folder).

Nothing that needs your consent runs before you choose. The cookie settings list two purposes, and below them a separate switch for error reports:

• Necessary: signing in, security and remembering your cookie choices and your error-report setting: the cookies above and the stored choices themselves. Always on, because the site cannot work without them.
• Analytics: Google Analytics, loaded through Google Tag Manager, which never receives your account, your name or the name of anything you work on; and, separately, our own statistics on our servers, which link the pages you open to your account while you are signed in.

Error reports, which are not a consent purpose: whenever something breaks, your browser sends an error report to our error-monitoring provider (Sentry), which may include browser details and the page where the error occurred. They set no cookie and store nothing on your device, and secrets are removed before a report is sent. We send them on the basis of our legitimate interest in keeping the service working and secure (GDPR Art. 6(1)(f)), because without them we cannot find what breaks. They are on by default, signed in or not, and the switch beside them is your right to object (GDPR Art. 21): switched off, your browser sends no error reports.

Storing information on your device or reading it from there for Analytics requires your consent under § 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications, and the personal data involved are processed on the basis of that consent (GDPR Art. 6(1)(a)). The cookies above, your stored choices and your error-report setting need no consent, because they are strictly necessary for the service you asked for.

The cookie banner offers three buttons. “Necessary only” and “Accept all” are equal choices: the first refuses Analytics, the second allows it. “Customize” opens the cookie settings, which show each purpose with its description and its own switch (the Analytics switch off until you turn it on) and record your selection with “Save choices”; “Necessary only” and “Accept all” are there too. The error-report switch sits apart from these buttons, on until you turn it off, and takes effect as soon as you move it; none of the three buttons changes it. Closing the settings, or leaving the banner without choosing, allows nothing that needs your consent. The banner also tells you that error reports are sent and where to switch them off. The banner asks every visitor who has not decided, also after signing in; accepting the Terms of Service is not this consent.

If you choose “Necessary only”, or make no choice, your page views are counted against no one, and no tag manager and no measurement tag is loaded at all: not loaded and restrained, but never fetched. Google Tag Manager is loaded only if you allow Analytics; error reports never load it. Error reports do not depend on this choice: they are sent until you switch them off.

We remember your decision (a refusal just as much as a consent) for 6 months, in your browser’s local storage, and the banner asks again after that. It also asks again sooner if we change how this policy describes the purposes, because an earlier answer was given to a different text. A switched-off error-report setting does not lapse: it stays until you switch reports on again or clear this site’s stored data. An earlier refusal of the former Diagnostics purpose is not read as switching error reports off, because it answered a request for consent.

You can change or withdraw your choice at any time, as easily as you gave it: through “Cookie settings” in the footer of our website or in the account menu of the app, or in Settings → Legal & privacy. Clearing this site’s stored data also makes the banner ask again. Switching error reports off, in the same places, stops them on the spot. Withdrawing Analytics takes effect on the spot too: the tag manager is told that analytics is denied, nothing further is sent to it, the Google Analytics cookies (“_ga” and “_ga_K834Y3NKQ9”) are deleted from your browser, your page views stop being linked to your account, and the page is free of the tag manager as soon as you reload. Error reports from our servers are described in the Privacy Policy.

If you allow Analytics, your browser loads Google Tag Manager from Google Ireland Limited. The tag manager itself collects nothing; it loads the one measurement tag we have configured, Google Analytics, which shows us which of our pages people arrive on and how they move through our website and web app.

Google Analytics sets two first-party cookies, that is, cookies of our own site, and only if you allow Analytics: “_ga”, which distinguishes one browser from another, and “_ga_K834Y3NKQ9”, which keeps the state of a visit. Both expire 13 months after your first visit. The current cookies are always visible in your browser’s storage for this site.

For our public pages, Google Analytics receives the page’s address, its title and the page you came from. For screens inside the product it receives only the shape of the address (for example /projects/:id) and a general title of the screen, never the address itself, its query string, or the name of a project, workspace or anything else you work on, so no project, workspace or account identifier reaches Google; we send Google no identifier of your account at all. It also records which of our pages you scroll to the end of, links to other sites you click, files you download, videos you play and searches on our site, together with what your browser sends with any request, including your IP address and browser details. As a safety net, Google Analytics removes email addresses and address parameters that can carry sign-in codes or tokens before it stores anything. Google signals, which would link visits to Google accounts, is off.

For Google Analytics, Google acts as our processor. It processes the data only on our instructions, under the Google Ads Data Processing Terms, which are Google’s processor terms for Google Analytics too and which we have accepted, and we do not allow it to use the data for its own products and services. Google Analytics keeps the data of individual visits for 14 months. Google Ireland Limited may have the data processed by Google LLC in the United States under the EU–US Data Privacy Framework; the Privacy Policy sets out the transfer safeguards.

Before anything is loaded, the tag manager is told that every optional purpose is denied, and then that you allowed Analytics; every advertising purpose stays denied, so no tag can assume a consent you did not give.

Our public pages show a chat button. Until you click it, the chat loads nothing and stores nothing. When you open it, the chat, provided by Namiru (Crowie s. r. o.), keeps two entries of its own in your browser’s storage for this site: a random visitor identifier, kept for 30 days after your last chat, and a session identifier for the open tab, so that the conversation can continue. They set no cookie and are not used to track you across sites. They need no consent, because they are strictly necessary for a service you asked for by opening the chat. The chat is not shown inside the product. What the chat receives and who processes it is described in the Privacy Policy.

Separately from the tag manager, and whatever you choose, the product usage records and page views described in the Privacy Policy are counted on our own servers. Counting them uses no cookie, local storage or device identifier of its own, and no third party receives them. A page view is linked to your account only when you are signed in and have allowed Analytics.

You can delete or block cookies in your browser settings. Blocking the session cookie prevents signing in; deleting it signs you out. Deleting this site’s cookies also removes any the measurement tags set, and clearing its stored data makes the consent banner ask you again.

Questions about cookies: info@throughplan.com.