Cookie and Local Storage Notice
Effective: 8 October 2026
This notice describes the cookies and other local storage used by the daya website and mobile app, operated by PAP NOÉMI E.V.. The details of the processing - legal bases, retention, your rights - are in the Privacy Policy.
The single most important sentence: we use no advertising cookies, we build no profiles, and without your consent we set only the handful of cookies the site cannot work without.
1. Four different things - definitions
This notice keeps four things apart that differ both legally and technically. All four are data stored on, or tied to, your device, so the rules on storing information on a user's device (the electronic communications rules) apply to each of them.
| Term | What it is | Where it lives | Covered in |
|---|---|---|---|
| Cookie | a small file stored in your browser that the browser automatically sends back to the server with requests | your browser | sections 2 and 3 |
| Browser local storage (localStorage) | data stored in your browser that does not travel with requests; only the website's own code reads it | your browser | section 4 |
| App storage on the device | the mobile app's own storage on your phone, walled off from other apps | your phone | section 5 |
| Technical identifier | an identifier tied to your device that is not a stored file - for example the device address used to deliver push notifications | our systems and the delivery provider | section 5 |
The mobile app uses no cookies at all.
2. Strictly necessary cookies
Without these, signing in, language selection and abuse protection would not work, so under the ePrivacy rules they may be set without consent. We do not measure anything with them and we share them with no one.
| Cookie | What it stores | Set by | Lifetime |
|---|---|---|---|
daya_rt | the key used to renew your session. HttpOnly: the site's own JavaScript cannot read it, and the browser only ever sends it to the API | daya | 30 days |
daya_sh | only which interface to render (customer, salon, staff member or administrator). It contains no identifier and no session key - its job is to stop the page flashing on load | daya | 30 days |
i18nextLng | the language you chose | daya | 1 year |
__cf_bm and Cloudflare's other protection cookies | filtering automated and abusive traffic in front of the API | Cloudflare, Inc. | short, typically 30 minutes |
3. Cookies that start only with your consent
Until you allow them, they are never created - the measurement code is not even loaded. This is strict opt-in: no consent does not mean "we will decide later", it means nothing is collected.
| Cookie | Purpose | Set by | Lifetime |
|---|---|---|---|
_ga, _ga_<id> | anonymous usage statistics in Google Analytics 4: which screens are viewed, where a booking is abandoned | Google Ireland Ltd. / Google LLC | up to 2 years |
We never send names, email addresses or phone numbers to an analytics system, and the measurement cannot identify you personally.
4. Browser local storage (not cookies)
The website keeps the following in your browser's local storage. They do not travel with our requests, and signing out or clearing your browser data removes them:
| Key | What it stores |
|---|---|
token | the short-lived access key the API authenticates you with |
analyticsConsent | your decision under section 3 (granted / denied) |
| appearance setting, active salon | the colour preset you picked and, with several salons, the one you are currently working in |
5. The mobile app: device storage and technical identifiers
The app uses no cookies.
Device storage. Sign-in data is held in the device's secure storage (iOS Keychain, Android Keystore). Settings (language, appearance, active salon, your decision on usage statistics) are kept in the app's own storage. They are removed when you sign out or uninstall the app.
Technical identifiers.
- Push notification device address - created when you allow notifications. We store it on our server to deliver booking notifications, and delete it when you sign out or delete your account.
- Crash reports - if the app crashes or hits a serious error, a technical report (device model, OS version, app version, where the error occurred) is sent to Google Firebase Crashlytics. This is needed to fix faults, and without your consent it carries no user identifier; we attach one only if you have consented to usage statistics.
Measurement starts only with your consent here too, under the same rule as on the web. We do not use the advertising identifier (IDFA) and do not track you across apps or devices.
Your decision on usage statistics is tied to the device, not the account: if you use both a customer and a salon account on the same phone, your decision applies to both.
6. How to change your decision
- On the web: as a customer in the Profile → Edit profile dialog, as a salon under Dashboard → Appearance.
- In the app: under Analytics on the Profile or Manage screen.
- In your browser: you can also delete cookies already set from your browser's settings. Deleting the section 2 cookies signs you out and may lose your language choice.
Withdrawing is as easy as giving consent, and takes effect immediately going forward.
7. Changes and contact
If we introduce a new cookie we describe it here first, and where it requires consent we ask first. Questions: info@daya.now.