Magyar Back to CalMate

CalMate Cookie Notice

Version: 1.2
Last updated: 19 September 2026
Effective date: 19 September 2026

This notice describes the cookies and other browser storage used on CalMate’s public website and web application interfaces. See the Privacy Notice for further details about processing.

1. Categories

2. Essential cookies

Name Provider and scope Purpose Expiry
calmate_session CalMate, current host Securely maintaining the session and sign-in. By default, after 120 minutes of inactivity.
XSRF-TOKEN CalMate, current host Protecting forms and requests from forged actions initiated by another website. With the session.
calmate_cookie_consent CalMate; .calmate.hu in production Stores the decision for convenience and analytics categories, the schema version and decision time. It provides one setting across our subdomains. No more than 12 months.
_GRECAPTCHA Google reCAPTCHA, recaptcha.net Risk analysis protecting industry enquiry forms against automated abuse. It may be used only when reCAPTCHA is executed. Duration determined by Google.
cf_clearance Cloudflare, the protected production calmate.hu website Records successful Managed Challenge verification to reduce repeated challenges. Configured lifetime: 30 minutes.

In production, the consent cookie uses Secure, SameSite=Lax and Path=/. It is host-only in local and test environments.

Cloudflare’s full-page challenge protects workplace (/login) and system-administrator (/system/login) sign-in and related QR requests on the production website. The cf_clearance cookie is essential for security, so the analytics setting does not disable it. Cloudflare may apply additional clock-skew and background-request grace periods when checking validity. See Cloudflare Challenge Passage. Local test sites and the mobile API do not use this browser challenge.

3. Convenience cookies and browser storage

These items are retained only after the Convenience settings category has been allowed. They are deleted when permission is withdrawn; the current page remains usable for the rest of the session.

Name Type and scope Purpose Expiry
appearance Cookie, current host Remembers the light, dark or system appearance. No more than 12 months.
appearance localStorage, current origin Applies the selected appearance on the client. Until withdrawal, deletion or the browser data is cleared.
language localStorage, current origin Remembers the selected web-interface language. Until withdrawal, deletion or the browser data is cleared.

A signed-in user’s language saved server-side on their account is not a cookie and is not part of this optional browser storage.

4. Google Analytics and Advanced Consent Mode

Name Provider and scope Purpose Expiry
_ga Google Analytics, the calmate.hu host Random browser identifier used to distinguish visits. No more than 12 months.
_ga_<measurement-id> Google Analytics, the calmate.hu host Maintains GA4 session state. The exact suffix depends on the measurement ID. No more than 12 months.

These cookies may be created only after the Analytics category has been allowed. On withdrawal, analytics storage is denied and _ga and _ga_* cookies belonging to the calmate.hu host are deleted. If consent is withdrawn on another subdomain, the shared consent becomes denied immediately; the main domain’s host-only GA cookies are removed before GA is configured on the next calmate.hu page load.

The public marketing pages, workplace QR sign-in and selected webadmin screens use Google Advanced Consent Mode, only on the configured production website. All storage and advertising states are denied before the Google tag. ad_storage, ad_user_data and ad_personalization always remain denied. Without analytics consent no _ga cookie is created, but Google may receive limited cookieless measurement signals. Measurement does not contain CalMate account or workplace identifiers, names, email addresses, workplace names, tokens, messages or form-field values.

On workplace interfaces, we measure actual page opens and successful sign-in after authentication is complete, including two-factor verification where required. We send only predefined screen names, paths without individual identifiers or parameters, and the QR-code or password sign-in method; filtering and background refreshes do not count as new page views.

Google Analytics is absent from system-administration, reseller, password-management, security and token-bearing interfaces, legal notices and account-deletion pages. Workplace usage involving system-administrator impersonation, system administrators or users excluded from analytics is also omitted. Local and test environments do not send production measurements.

5. External resources

The website continues to load its Font Awesome JavaScript kit from the external kit.fontawesome.com source. During the request, the provider may receive technical connection data such as the IP address, browser type, referring page and timestamp. This resource is not disabled by the cookie setting.

To protect the industry enquiry forms, reCAPTCHA JavaScript is loaded from www.recaptcha.net. The service produces a risk score from technical interaction and browser information and may use the necessary _GRECAPTCHA cookie. reCAPTCHA is a security feature, so it is not disabled by the analytics setting; the form cannot be submitted without it.

6. Managing settings

On the first visit, a person can accept all categories, use essential storage only, or configure each category. The choice can later be changed from the Cookie settings button in the bottom-right corner of every CalMate web interface.

Cookies and website data can also be deleted or blocked in the browser settings. Blocking essential cookies may prevent sign-in, forms or parts of the web application from operating correctly.

For privacy questions, contact [email protected].

Privacy control

Essential

Authentication, security, forms and your consent choice. These cannot be disabled.

Always active