Cookie notice
Draft. A lawyer finishes this before launch. The headings and the plain summaries stay.
- Needed to work
- Keeps you logged in and remembers your settings. Always on.
- Crash reports
- Tells us when the app breaks. Off until you allow it.
- Nothing else
- No ads, no tracking across other sites, nothing sold.
- Changing your mind
- Turn crash reports on or off any time in Your data.
THE FULL TEXT
DRAFT, needs legal review. Not yet in force.
Diddo runs no analytics software, no advertising, no tracking and no behavioural profiling. The cookies below are needed for the service to work and are always on. The one thing you choose, once, before you sign up, is whether crash reports may be sent. They are off until you turn them on, and you can turn them off again under Settings, Your data. (No crash reporting service is connected yet.)
Cookies we set
| Name | What it is for | Lifetime | Notes |
|---|---|---|---|
session | Keeps you signed in. Holds a random token; we store only a hash of it on our side. | 30 days, renewed while you use the app. Removed when you log out or delete your account. | First party, HttpOnly, SameSite=Lax, Secure on the live site. Set only when you log in or sign up. |
city | Remembers the launch city you picked when you chose not to share your location, so Nearby can show that city. | 180 days. Removed when you clear your choice. | First party, contains a city name such as stockholm. Set only when you pick a city. |
diddo_consent | Remembers your cookie choice: needed only, or crash reports too. | 1 year. Removed when you log out. | First party, SameSite=Lax. Holds v1.needed or v1.both, nothing else. |
diddo_days | Counts on how many different days this browser opened Diddo, and whether you posted from it, so we can suggest installing the app at a sensible moment and never on your first visit. | 1 year. | First party, HttpOnly. Holds a number, a date and a yes or no, and after "Not now" on that suggestion, how many times and the date. Set only after you have made your cookie choice. |
signup_flow, reset_flow | Keeps your place while you make an account or reset your password, between typing the code and the next step. | 1 hour, or until you finish. | First party, HttpOnly. Holds a random token; we store only a hash of it. |
pseal | Holds the phone number you just typed, encrypted so that only our server can read it, so "Send a new code" and "It's my number now" work without you typing it again. | 15 minutes, or until the code is in. | First party, HttpOnly. Encrypted and signed; the number is never readable from it. |
spot_view | Remembers which of your spots you last opened from the switch sheet when it cannot be posted as yet (not paid, or lapsed), so the spot pages show that spot. | Until you close the browser, switch back to yourself or log out. | First party, HttpOnly, SameSite=Lax. Holds the spot's number, nothing else. Set only when you pick such a spot. |
clear_local | Tells the page right after you log out to clear what Diddo kept on this device, except the app itself. | 5 minutes, or until the page has done it. | First party. Holds 1. |
toast | Carries a short message to the next page, such as "Saved". | 1 minute. | First party, HttpOnly. |
Before you make the cookie choice, visiting Diddo while logged out sets no cookie at all unless you pick a city.
Other storage on your device
- Offline shell. Our service worker keeps a copy of the offline page, the app's public stylesheets, scripts, fonts and icons so the app opens quickly and can tell you when you are offline. It never keeps pages that contain your data, API responses, photos, videos, map tiles or anything from Nearby. Logging out clears everything Diddo kept on your device except this shell. Clear site data in your browser to remove it too.
- Push subscription. If you turn on push notifications, your browser stores a subscription that identifies it to your browser vendor's push service. See the privacy policy.
- Map position. The map remembers where you were looking (
diddo.mapin this tab's session storage), so going back from a place page keeps your spot. It stays on your device, is never sent to us and is gone when you close the tab. - Recent searches. Search remembers your last few searches (
diddo.recent-searchesin this browser's local storage) so you can tap one again. It stays on your device and is never sent to us. Remove one with its cross, or all of them by logging out. - Use my location for Nearby. If you turn this off under Settings, the choice is kept on this device only (
diddo.nearbyin local storage), and Nearby then never asks this device for its position. It is never sent to us, so each of your devices has its own setting. Logging out turns it back on. - We do not use localStorage, IndexedDB or fingerprinting to recognise you.
Third parties
Diddo loads no scripts, fonts, styles or images from third-party hosts. The map is served from our own infrastructure.
Your choices
You can clear cookies and site data in your browser at any time. If you clear the session cookie you will be logged out. Questions: privacy@<domain> (TODO: set when the domain is final).
FriendsCorp, org. nr TBD, Eskilstuna, Sweden