Cookie Policy
Last updated: 29 July 2026 · version 1
This page lists every cookie and similar technology (including localStorage) that this site and the embedded booking calendar can place in your browser, and what each optional category collects. There are two optional categories, Analytics and Session replay, and you choose them separately. We set no advertising or cross-site tracking cookies.
Strictly necessary
Required for the site and the booking flow to work. They need no consent, but we document them.
| Name | Type | Provider | Party | Duration | Purpose |
|---|---|---|---|---|---|
| s4-consent | localStorage | squad4.digital (us) | First-party | Until deleted, or until the policy version changes | Stores your cookie decision: policy version, timestamp and accepted categories. |
| __Secure-next-auth.csrf-token, __Secure-next-auth.callback-url | cookie | calendar.squad4.digital (our self-hosted calendar) | First-party (own subdomain) | Session | Security (CSRF protection) and correct operation of the booking page inside its frame. Set only when the booking calendar loads. |
| cf_clearance | cookie | Cloudflare (our hosting provider) | Third-party provider, first-party context | Up to 1 year | Set only if Cloudflare challenges a visit it considers suspicious; remembers that the challenge was passed so it is not repeated. Not set on normal visits. |
| __cf_bm | cookie | Cloudflare (our hosting provider) | Third-party provider, first-party context | ~30 minutes | Bot detection and infrastructure security for the hosting platform. Set only while bot protection is actively evaluating a visit; not observed on normal visits. |
Analytics - only after your consent
Nothing in this group exists in your browser before you accept the Analytics category, and everything is deleted when you withdraw.
| Name | Type | Provider | Party | Duration | Purpose |
|---|---|---|---|---|---|
| ph_phc_*_posthog | localStorage | PostHog (EU cloud), reached via our own /ingest address | First-party storage | Until you withdraw consent or clear site data | A pseudonymous visitor identifier and the event queue: pages viewed, page leaves, clicks and scrolling, page-speed measurements, and the two lead events (brief submitted, booking confirmed). Your IP address is never stored with these events. |
| ph_phc_*_posthog, ph_phc_*_window_id, ph_phc_*_primary_window_exists | sessionStorage | PostHog (EU cloud), reached via our own /ingest address | First-party storage | Until you close the browser tab | Keeps one visit together as you move between pages, and tells apart two tabs open at the same time. |
Session replay - only after your consent
A separate choice from Analytics, and off unless you enable it. It needs Analytics on, because it reuses the same visit identifier.
| Name | Type | Provider | Party | Duration | Purpose |
|---|---|---|---|---|---|
| No entry of its own | not stored in your browser | PostHog (EU cloud), reached via our own /ingest address | First-party request | Recordings are kept up to 30 days, then deleted by PostHog | Records your visit as a replayable video - mouse movement, clicks, scrolling and the structure of the page - so we can see where the site gets in your way. It adds nothing to your browser storage: the recording is sent to PostHog and linked to the visit identifier listed above. Anything you type is masked, and the contact form is excluded from recording entirely. |
Manage your consent
Change your choice at any time, per category. Turning off Session replay stops the recording immediately; turning off Analytics stops all collection and deletes the identifiers listed above from your browser.
Open cookie settingsWith JavaScript disabled, no analytics runs and there is nothing to configure. The stored preference can be removed from your browser’s site-data settings.
What cookies and similar technologies are
Cookies are small files a website stores in your browser; localStorage is a similar browser storage without an expiry date. Both can hold identifiers. Romanian Law 506/2004 and the GDPR require your consent before any that are not strictly necessary are placed.
How consent works here
Strictly necessary items are always active - the site cannot work without them. Both optional categories are off by default and start only after you accept them in the banner; before that, no analytics request leaves your browser, no recording is made and no analytics entry is stored. Session replay is a separate tick from Analytics, so accepting Analytics alone never records your visit.
Your decision is saved with the policy version, a timestamp and the accepted categories. If this policy changes materially — new purposes, categories or providers — the version changes and the banner is shown again; your previous choice is not carried over.
The booking calendar frame
The booking page embeds our self-hosted calendar from calendar.squad4.digital. The cookies it sets are strictly necessary for booking (security and session), exist only inside that frame, and are not used for tracking. Session replay cannot see inside that frame, so what you enter in the calendar is never recorded. How booking data itself is processed is described in the Privacy Policy.