Cookie policy

What cookies are

Cookies and browser storage are small pieces of data saved on your device. We store or read information there only when it is strictly necessary for a service you asked for, or when you consent (art. 399 of the Polish Electronic Communications Law). For each item we say who sets it, why and for how long.

Strictly necessary (no consent needed)

Without these you cannot sign in and the site cannot be kept secure. They are not used for tracking.

• __Secure-next-auth.session-token (Hug a Story; without the __Secure- prefix outside HTTPS): keeps you signed in; up to 7 days.
• __Host-next-auth.csrf-token and __Secure-next-auth.callback-url (Hug a Story): secure and complete sign-in; until you close the browser.
• next-auth.state, next-auth.pkce.code_verifier and next-auth.nonce (Hug a Story): only while signing in with Google, they protect it from interception; 15 minutes.
• NEXT_LOCALE (Hug a Story): remembers the language you chose; until you close the browser.
• __cf_bm (Cloudflare, our site protection provider): tells people from bots and protects against attacks; 30 minutes. Read by Cloudflare.
• cf_clearance (Cloudflare): set only when you pass a Cloudflare security check; up to 30 minutes. Read by Cloudflare.

Browser storage (no consent needed)

These conveniences live only in your browser and never reach us or anyone else:

• cookie-consent: your cookie choice; until you change it or clear your browser data.
• bajki:reader: page colour and text size in the reader; until you clear your browser data.
• bajki:last-read, bajki:read: where you stopped reading and which stories you have read; until you clear your browser data.
• bajki:create-draft, bajki:after-checkout: an unfinished story idea and where to return after payment; until you close the tab.

Mobile app

The app uses no cookies and no analytics or advertising tools. On your device it stores sign-in data (in the system's secure storage), settings, reading progress, the “Story time” reminder and stories downloaded for offline listening. Sign out or uninstall the app to remove them.

Analytics (only with consent)

If you accept analytics cookies, we load Google Analytics 4 (provider: Google Ireland Ltd), which sets the _ga and _ga_<id> cookies for 2 years to count visits and see which pages are useful. Google has access to them. Google Analytics 4 does not store the IP addresses of users in the EU: it uses them only for approximate location and discards them at once. We keep Google Analytics data for 2 months.

After this consent we also set our own cookies: hs_analytics (remembers the consent so the server knows it may record where a sign-up came from; 1 year), hs_attr (the campaign of the first visit: utm_source, utm_medium, utm_campaign and the referring site; 30 days) and hs_signup (after a Google sign-up, lets Google Analytics count it; 10 minutes). When you create an account, the source from hs_attr is saved with it so we know which channels bring families. When you withdraw consent, we delete these cookies.

If you decline or make no choice, the Google Analytics script does not load at all and nothing is sent to Google.

Marketing (only with consent, when we run ads)

When we run ad campaigns and you accept marketing cookies, we load the Meta pixel (provider: Meta Platforms Ireland Ltd; the _fbp cookie for 3 months) and the Google Ads tag (provider: Google Ireland Ltd; the _gcl_au cookie for 3 months). They measure which ads bring families and let ads be shown to people similar to our customers. Meta and Google have access to these cookies and process the data under their own rules.

Without this consent none of these scripts loads. You can withdraw consent at any time in the cookie settings.

How to change your choice

Change your choice or withdraw consent at any time with the button below or the “Cookie settings” link in the site footer. You can also block or delete cookies and site storage in your browser settings; if you block strictly necessary cookies, you will not be able to sign in.

Read more about how we handle data in the privacy policy.