Cookie Policy
Effective: 23 August 2026
1. Scope
This Cookie Policy describes cookies and equivalent browser storage used by
Remény Farm Kft. on chirpcoop.com and tyutyu.hu. The hosts provide
the same capabilities; host selection changes language and brand, not feature
availability. See the Privacy Policy for the wider processing notice.
The Policy covers cookies, localStorage, sessionStorage, and scripts that
access a device. It reflects the GDPR, the ePrivacy Directive, and section
155(4) of Act C of 2003 on Electronic Communications. It describes shipped
behavior and is not a statement that a particular legal basis will apply in
every jurisdiction.
2. Current first-party storage inventory
| Item | Storage and purpose | Retention | Category |
|---|---|---|---|
chirp-consent-v1 | localStorage; records separate analytics and marketing choices, version, and update time so the Service can honor them. | Until changed, browser storage is cleared, or the format is replaced. | Strictly necessary preference |
sb-<project-ref>-auth-token | Supabase localStorage; access and refresh tokens maintain a requested signed-in or anonymous session. | Session lifetime, until sign-out, token expiry/revocation, or browser-storage deletion. | Strictly necessary |
chirpcoop.pendingMailerLiteEmailSync | localStorage; a 24-hour, versioned marker used after an account-email change to queue the confirmed address for MailerLite sync. It contains the opaque account ID, SHA-256 digests of the old and target normalized addresses, and expiry; it contains no plaintext email. | At most 24 hours; cleared on invalid data, mismatch, sign-out, or successful queueing. | Strictly necessary account operation |
chirp_ephemeral:<path>:<name> | sessionStorage; temporarily retains a checkout bearer value (session_id or gift code) after removing it from the visible URL so the return/redemption flow can finish safely. | Usable for at most 6 hours; removed when consumed or cleared, when an invalid/expired value is read, or when the tab session ends. | Strictly necessary checkout/redemption operation |
chirp_pick_token | sessionStorage; opaque server-issued token proving the current anonymous hen reservations. | Until checkout/abandonment clears the pick session or the tab session ends. | Strictly necessary checkout operation |
chirp_pick_draft | sessionStorage; selected quantity, candidate display data, and reservation expiry used to restore the direct-pick checkout after a refresh. Server reservations remain authoritative. | Until checkout/abandonment clears the draft or the tab session ends. | Strictly necessary checkout operation |
chirp-referral-discount | localStorage; the member invite slug from an invitation link (/m/<slug>, or an older ?w= or ?ref= link) and its capture time. The slug is a member's public handle or a short invite code, never an email address or a name. It is sent with a waitlist signup and with checkout so the invited friend's promised first-month discount can be applied and the inviting member's queue places or capped bonus month can be credited server-side. An older chirp-waitlist-ref item, if a browser still holds one, is read once and deleted. | 30 days from capture; also removed when invalid or expired. Not removed when marketing consent is withdrawn. | Strictly necessary invitation, signup and checkout operation |
chirpcoop.reelSound | localStorage; records the visitor's on/off preference for checkout-reel sound. | Until changed or browser storage is deleted. | Strictly necessary interface preference |
chirpcoop.discordBannerDismissed | localStorage; value 1 remembers that a signed-in Patron dismissed the Discord community prompt. | Until browser storage is deleted. | Strictly necessary interface preference |
chirpcoop:golden-basket-promo-dismissed:v1 | localStorage; value 1 remembers that a signed-in Patron permanently dismissed the Golden Basket promotional prompt. | Until browser storage is deleted or the prompt format is replaced. | Strictly necessary interface preference |
chirp-referral | localStorage; consented last-touch referral handle and utm_source, utm_medium, and utm_campaign, plus capture time, for checkout attribution. | 30 days from capture; also removed when invalid, expired, or marketing consent is withdrawn. | Marketing |
chirp_checkout_attempt:<kind> | sessionStorage; random attempt ID links a consented gift or RealChirp checkout sequence. | Current browser-tab session; removed on marketing withdrawal. | Marketing |
ty_sales_visit_logged | sessionStorage; with marketing consent, prevents the first-party sales-visit counter from being incremented repeatedly in one tab session. | Current browser-tab session; removed when marketing consent is withdrawn. | Marketing |
Framework or security providers may use short-lived operational state where it
is strictly necessary to deliver a request securely. The hosted Cloudflare
Turnstile token itself is memory-only: it is not written to cookies,
localStorage, sessionStorage, URLs, analytics, logs, or rendered HTML and is
passed only to Supabase Auth.
3. Optional measurement and processors
No optional measurement script or event is enabled before the relevant stored consent is present. Missing, invalid, blocked, or unwritable consent storage is treated as refusal. Authenticated, admin, account, redemption, game-bootstrap, and other sensitive routes and auth-secret URL fragments remain browser- telemetry-free regardless of choice.
| Category | Processor / technology | Data and purpose | Browser storage / retention |
|---|---|---|---|
| Analytics | Vercel Analytics and Speed Insights (Vercel Inc.) | Consented public-page use and performance measurements. The provider necessarily receives the request and measurement context needed to deliver these services. | The Service does not create a Vercel storage item. Provider-side data follows the configured Vercel retention and contract. |
| Analytics | PostHog Inc., through same-origin /ingest | Profileless public sales/funnel events under an ephemeral in-memory random ID. Allowed fields are limited to: event name; host, path, locale, surface, placement, target, section/FAQ/calculator values; checkout attempt, quantity, duration, provider, status/error; order ID, currency and value; picker counts; referral handle and UTM values; and share moment/channel. GeoIP processing and person profiles are disabled. | No PostHog cookie or durable PostHog ID. The random ID lasts only for the loaded document. Provider-side events follow the configured project retention. |
| Analytics + marketing | Google Tag Manager container with Google Analytics 4 and Google Ads conversion measurement (Google LLC) | The container loads on eligible public pages only after both stored choices are granted. GA4 measures consented public-page activity; GA4 and Google Ads receive the consented RealChirp begin_checkout event with total value, currency, quantity, and stable item ID/name/category and unit price. It contains no email, order ID, payment-session token, or referral value. | Depending on the enabled tag and granted state, Google tags may create first-party _ga, _ga_*, or _gcl_* cookies/identifiers; their lifetime follows the configured Google property/tag retention. No component of this container loads before both choices. |
| Marketing | First-party referral, sales-visit, and checkout attribution | The fields and markers in § 2 carry consented referral/UTM context to checkout, increment the sales-visit denominator once per tab, and prevent duplicate conversion reporting. | As listed in § 2. |
The Service does not use these tools for behavioural advertising and does not enable PostHog autocapture, session replay, or web person profiles. Separate mobile soft-launch telemetry is memory-only and is described in the Privacy Policy; it is not web cookie storage.
4. Choosing and withdrawing consent
The first eligible public visit presents separate Analytics and
Marketing choices. Rejecting all is equivalent to leaving both off. Google
Tag Manager requires both choices; Vercel measurement and PostHog sales events
require analytics consent; referral and checkout attribution require marketing
consent, as does the first-party once-per-tab sales-visit counter. The
chirp-referral-discount item is functional invitation processing, not optional
marketing measurement: it carries only the invite slug needed to perform the
invitation offer, and it works independently of these choices, including when
you reject the banner. The slug is sent with a waitlist signup so the server can
record the inviting member, and with checkout so the invited friend's
first-month discount can be applied (card payments only). The server validates
the slug, ignores it when it belongs to the visitor's own email address, records
the conversion after payment, and then fulfills the inviting member's reward:
queue places for a member on the waitlist, or a bonus month for a member with an
open patronage, subject to the monthly anti-abuse cap. An invitation page
(/m/<slug>) runs no browser measurement; UTM values and analytics events stay
subject to the choices above.
The Cookie settings control in the footer reopens the choices at any time. Withdrawal blocks future sink calls immediately, removes the first-party marketing storage listed above, sends a denied Google consent update when its runtime exists, and reloads the document after revoking an active runtime so installed third-party listeners do not remain. Withdrawal does not affect the lawfulness of processing before withdrawal and does not itself erase data already received by a processor; use the Privacy Policy contact to request access or erasure where applicable.
Blocking all browser storage may prevent authentication and account-email operations from working. Browser controls can also delete stored items at any time.
5. Recipients and international transfers
Optional measurement data is received by the processors named in § 3 and by their contracted subprocessors as necessary to operate the service. Supabase receives authentication data; Cloudflare receives Turnstile security signals and stores/delivers uploaded avatar and real-chicken image objects through R2/CDN under the retention described in the Privacy Policy. Where processing involves a transfer outside the EEA, we rely on the relevant provider's applicable transfer mechanism, such as an EU–US Data Privacy Framework participation or Standard Contractual Clauses, as documented in the provider agreement. See the Privacy Policy for the processor inventory.
6. Contact and complaints
Questions, withdrawal follow-up, and data-subject requests can be sent to the
contact in the Privacy Policy. We respond within the period required
by applicable law. You may also complain to your competent supervisory
authority. In Hungary this is the National Authority for Data Protection and
Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11,
naih.hu, ugyfelszolgalat@naih.hu.