Effective date: 9 May 2026
1. Purpose of this page
This page describes the cookies and similar storage technologies (in particular localStorage and sessionStorage entries) used by Zavod Novi in the operation of the Service at gravelatlas.com. It is published in implementation of Article 5(3) of Directive 2002/58/EC (the “ePrivacy Directive”), as transposed into Slovenian law by Article 157 of the Electronic Communications Act (Zakon o elektronskih komunikacijah, ZEKom-2). For the underlying processing of personal data, the Privacy Policy applies.
2. How to manage preferences
2.1 On the User's first visit to the Service, a consent banner is displayed offering three options of equivalent prominence: “Accept all”, “Essentials only”, and “Customize”. Selecting “Customize” opens a panel in which the User may grant or refuse consent for each non-essential category separately.
2.2 The User may revise the consent choice at any time. The “Cookie preferences” link in the site footer reopens the consent panel, as does the button below.
2.3 Where consent is withdrawn for a category, processing on the basis of that consent ceases from the moment of withdrawal, in accordance with Article 7(3) GDPR. The lawfulness of processing carried out prior to withdrawal is not affected.
2.4 The User's choice is recorded together with a timestamp and the version of this page in force at the time of the choice, in order to evidence consent in accordance with Article 7(1) GDPR. Zavod Novi will re-prompt for consent where a new category is introduced, where a processor in an existing category changes in a manner material to the User, or where twelve (12) months have elapsed since the last choice.
3. Strictly necessary cookies
The following entries are required for the Service to function and are therefore not subject to consent under Article 5(3) ePrivacy Directive (transposed into Slovenian law by ZEKom-2 Article 157(2)).
| Item | Purpose | Storage | Retention |
|---|---|---|---|
next-auth.session-token (or __Secure-next-auth.session-token over HTTPS) | Authenticated session | HTTP cookie, httpOnly | Up to thirty (30) days, refreshed on each visit |
site_access | Beta-access proof during the private-beta phase only. This cookie will be retired upon public launch. | HTTP cookie, signed (HMAC-SHA256), httpOnly | Thirty (30) days while the beta gate is active |
__cookie_test | One-off probe used by the access page to detect whether the browser blocks cookies. Will be retired together with site_access. | HTTP cookie | Deleted in the same response |
| NextAuth CSRF and callback cookies | Protect the sign-in flow | HTTP cookies | Session-bound |
bgUploads_<draftId> | Recovery of in-flight photo uploads on page reload | sessionStorage | Cleared when the upload completes or the tab closes |
ga_consent | Record of the User's consent choice on this page | HTTP cookie | Twelve (12) months |
4. Preferences
The following entries remember non-essential interface state. Processing is carried out only with the User's prior consent.
| Item | Purpose | Storage | Retention |
|---|---|---|---|
gravel-atlas-preferences | Units (kilometres or miles), preferred map style, default zoom level, whether the elevation profile is shown | localStorage | Until cleared by the User |
events:viewMode | Whether /events was last viewed in map or list mode | sessionStorage | Until the tab closes |
ecBannerDismissedAt | Cooldown timer for the Early Contributor banner | localStorage | Twenty-four (24) hours |
upgradeBannerDismissedAt | Cooldown timer for the upgrade banner | sessionStorage | Twenty (20) minutes |
5. Analytics
The following processing operations are carried out only with the User's prior consent.
| Item | Purpose | Storage | Retention |
|---|---|---|---|
| Vercel Analytics beacons | Page paths, the referring URL, and (where the User is signed in) the user identifier are transmitted to Vercel Inc. for the purpose of audience measurement | Network request only; no cookie set on the User's device | N/A |
First-party PageView records | A record is written to a Zavod Novi database table containing the path visited, the referring URL, any utm_* campaign parameters, the User-Agent, an approximate country derived from the IP at the network edge, a randomly-generated per-visit session identifier, and (where signed in) the user identifier | Neon (PostgreSQL), Frankfurt | Twelve (12) months |
ga_session_id | A randomly-generated identifier used to group page-view records from the same visit. This identifier is unrelated to Google Analytics, which is not deployed on the Service. | sessionStorage | Until the tab closes |
6. Third-party services that may set cookies
When the User accesses pages of the Service that load resources from the third parties listed below, those third parties may set cookies in the User's browser pursuant to their own policies. These cookies are not set by Zavod Novi and Zavod Novi does not control their content.
(a) Mapbox Inc. Map tiles, geocoding, and static-map renders are loaded from Mapbox on map-bearing pages of the Service (including /explore, /explore/plan, route pages, collection pages, and search pages). Mapbox's privacy notice is available at https://www.mapbox.com/legal/privacy.
(b) OpenStreetMap Foundation. Tile servers operated by the OpenStreetMap Foundation may be loaded as a basemap option on map-bearing pages. The OSM Foundation's privacy notice is available at https://wiki.osmfoundation.org/wiki/Privacy_Policy.
(c) CARTO. CARTO basemap tiles (Positron, Voyager) may be loaded as a basemap option on map-bearing pages. CARTO's privacy notice is available at https://carto.com/privacy.
(d) Stripe Inc. When the User initiates a Premium Subscription checkout, the checkout page is rendered by Stripe and Stripe sets cookies necessary to operate that checkout flow. Stripe's privacy notice is available at https://stripe.com/privacy.
The Figtree typeface (Google Fonts) is self-hosted by Zavod Novi; the User's browser does not connect to Google in order to load the typeface.
7. Browser controls and contact
7.1 In addition to the controls offered through the consent panel, the User may use the controls provided by the User's browser to refuse, restrict, or delete cookies. Instructions are maintained by the browser vendors at the following addresses:
Chrome: https://support.google.com/chrome/answer/95647
Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Safari (macOS): https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
Safari (iOS): https://support.apple.com/en-us/HT201265
Refusal of strictly necessary cookies will prevent the Service from functioning.
7.2 Questions about this page may be addressed to Zavod Novi by email at support@gravelatlas.com.