Cookie Policy

A cookie is a small text file the website saves in your browser. Similar technologies such as localStorage and sessionStorage work the same way and are covered by this policy.

Cookies let us, among other things, keep you signed in, remember your preferences, and process payments securely.

Sign-in (Firebase Authentication): we store a short token in your browser so you remain signed in between page views. Without this cookie you cannot log in.

Language preference: your selected locale (Swedish, English, …) is stored so we can show the right language on your next visit.

Theme: your light/dark preference is stored locally so the interface doesn't change appearance between visits.

Security (Firebase App Check): a short reCAPTCHA v3 attestation that helps us prevent automated abuse of our APIs.

When you go to checkout or manage your subscription you are redirected to Stripe. Stripe sets its own cookies to protect the payment against fraud and to make your session work. We do not have access to the cookies Stripe sets.

More information is available in Stripe's cookie policy at stripe.com/cookie-settings.

We do not use any third-party analytics cookies (no Google Analytics, Plausible, PostHog or similar).

We do not use any advertising cookies or cookies that track you across websites.

If we ever start using optional cookies — for example product analytics to understand how features are used — we will show a consent banner first where you can actively accept or decline.

iko_sess — session hint cookie. Tells our pages whether a user is signed in so the first paint shows the right header without an extra round trip. First-party, expires after 1 year.

NEXT_LOCALE — language preference. Set by next-intl when you switch language so we render the right locale on your next visit. First-party, expires after 1 year.

ikorkort:cookie-consent — localStorage. Records which cookie categories you accepted on the banner and when. First-party, no expiry (cleared when you reset browser data or change your preferences).

ikorkort:sessionId — localStorage. A random per-device identifier so we can enforce the 2-concurrent-session limit on a Premium account. First-party, no expiry.

firebase:authUser:* — localStorage / IndexedDB. Set by the Firebase Web SDK to remember your sign-in. First-party, managed by Firebase.

Stripe checkout cookies — set by stripe.com only while you're on the hosted checkout or customer-portal page. Required to protect the payment against fraud. We do not have access to them; see stripe.com/cookie-settings for details.

You can clear or block cookies at any time via your browser's settings. Note that if you block essential cookies you will no longer be able to sign in or use the core features of the service.

You can also reopen the consent banner via the 'Cookie preferences' link in the site footer to change which optional categories are allowed.

Help for the most common browsers is available at support.google.com/chrome, support.apple.com/safari and support.mozilla.org/firefox.