MARCIN BĘBEN
Cookie Policy
Last reviewed:
We use necessary features to keep this website working. With your permission, Google Analytics through Google Tag Manager measures visits and Microsoft Clarity records masked interactions to help us improve the website. Optional Cloudflare analytics may also measure page performance. Advertising stays off.
What cookies and similar storage do
Cookies can be sent to the server with requests; local storage and session storage keep data in your browser. The application uses these technologies for requested features and security. The current language is in the page address, not a language-tracking cookie. Opening an external profile link takes you to a separate website governed by its own policies.
Calculator and navigation
mb-calculator-v2 — first-party session storage containing your calculator inputs and progress. It lasts for the tab session and can be removed using the calculator’s reset control. Some browsers restore tab sessions, so use reset on a shared device.
positions — first-party session storage used by React Router to restore page scroll positions during navigation. It lasts for the tab session and does not contain your financial inputs.
Saved cookie-settings choice
mb-cookie-preferences-v1 — first-party local storage, written only when you save settings. It records that only necessary technologies are enabled, a version and a save time. The application recognises it for 180 days, then removes it on the next settings read. You can forget the saved choice in Cookie Settings or remove site data in your browser. This record is shared between the English and Polish versions and grants no optional tracking permission.
Administrative authentication
sb-…-auth-token (including numbered chunks when needed) — Supabase authentication cookies on this website’s domain, used when an administrator signs in. They are HTTP-only, SameSite=Lax and Secure on HTTPS. The installed authentication library sets a maximum cookie age of 400 days and may renew it; this does not mean the access token or server session stays valid that long. Sign-out clears authentication cookies. Ordinary visitors do not need an admin account.
Cloudflare security
Turnstile loads for enabled forms and when you request a calculator PDF download. It verifies submissions using technical signals; the verification token expires after five minutes and is not an advertising identifier. The local code does not configure pre-clearance. A live Cloudflare zone or widget may add security cookies depending on its account settings, including cf_clearance if pre-clearance is enabled. Exact production cookies and lifetimes have not been verified and must be audited in the live account before launch; they are not represented as already active here.
Managing your settings
Open Cookie Settings from any public footer to enable or disable website analytics, save your choice, or forget it. Necessary features cannot be switched off in this panel; browser storage settings may affect sign-in and progress retention.
Connecting an administrator’s Google Calendar
mb-google-connect is an essential HttpOnly, SameSite=Lax cookie used only when an authorised admin connects Google Calendar. It holds an encrypted, time-limited OAuth state and PKCE verifier, expires after 10 minutes and is cleared at callback. It is Secure on HTTPS. It is not used for visitors or analytics.
Optional website analytics
Optional Google Analytics via Google Tag Manager, Microsoft Clarity (masked session recordings and heatmaps), and Cloudflare Web Analytics where configured. Form contents and calculator financial inputs are excluded from tracking. Nothing loads until you accept analytics. Your choice lasts 180 days. Uncheck and save, or forget your choice, to withdraw consent; the page reloads to stop collection.
Preference record: mb-web-analytics-consent-v2 (180 days). Google Analytics uses _ga cookies; Microsoft Clarity uses _clck and _clsk cookies. GTM manages the analytics tags. Analytics consent does not grant advertising consent. Admin and authentication pages are excluded. Change or withdraw your choice through Cookie Settings in the footer. Provider information: https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement.
Calculator PDF downloads
A PDF is generated in your browser after you request a download and complete Cloudflare Turnstile verification. Verification uses a token and technical connection information; it does not send mortgage inputs or calculator results. The file contains the results from when you requested the download and is saved on your device.