Cookie Policy
- Version:
- 1.2
- Effective from:
- 30.09.2026
- Published:
- 30.09.2026
This English translation is provided for information only. The Polish version is the binding version.
This Policy explains which cookies and other device storage technologies are used by the BEON.RUN service (https://beon.run), operated by Radosław Balcerzak, balcerzak.it RADOSŁAW BALCERZAK, NIP 7631978291. The processing of personal data is described in the Privacy Policy.
§ 1. What cookies and browser storage are
Cookies are small text files saved by your browser. The Service also uses browser storage (localStorage, sessionStorage, IndexedDB, Cache Storage). Under Article 399 of the Polish Electronic Communications Law of 12 July 2024, storing information on your device or accessing it requires your consent unless it is necessary to provide a service you have explicitly requested or to transmit a communication.
§ 2. Categories
- Necessary – always on; the Service does not work without them (login, security, remembering your cookie choice, features you knowingly use). No consent is required.
- Analytics – Google Analytics 4; only with your consent.
- Marketing – a reserved category; the Service currently uses no marketing or advertising tools. If this changes, we will ask for consent again.
§ 3. Cookies and browser storage in use
This list is based on the cookies actually set in the browser (as of the version date of this document).
| Name | Provider | Category | Purpose | Duration | Type |
|---|---|---|---|---|---|
| PHPSESSID | BEON.RUN | necessary | sign-in and form session | until the browser is closed; the session ends after 30 min of inactivity or 48 h after sign-in | first-party, HttpOnly |
| REMEMBERME | BEON.RUN | necessary | automatic sign-in – only if you tick "Remember me" | 30 days | first-party, HttpOnly |
| mercureAuthorization | BEON.RUN | necessary | authorises real-time events for signed-in users (chat, GPS, notifications) | 1 hour, renewed | first-party, HttpOnly |
| __Host-csrf-token_… | BEON.RUN | necessary | protects forms against CSRF attacks | one-time, until the form is sent | first-party |
| bor_consent | BEON.RUN | necessary | remembers your cookie decision | 6 months | first-party |
| locale | BEON.RUN | necessary (functional) | remembers the language you chose manually (pl/en) | 12 months | first-party, HttpOnly |
| __cf_bm, _cfuvid, cf_clearance and other Cloudflare cookies | Cloudflare | necessary | protection against automated traffic and attacks – set only when the relevant Cloudflare protection feature is enabled (e.g. bot protection, rate limiting, browser challenge); on the date of the check (29.09.2026) beon.run pages set no Cloudflare cookies | __cf_bm – expires after 30 minutes of inactivity; others – according to Cloudflare's rules | set by the infrastructure provider |
| _ga | Google (Google Analytics 4) | analytics – only with consent | distinguishes visitors | up to 2 years (some browsers cap it at 400 days) | on the beon.run domain, written by Google's script |
| _ga_<id> | Google (Google Analytics 4) | analytics – only with consent | keeps the analytics session state | up to 2 years (some browsers cap it at 400 days) | as above |
| localStorage: beonrun.gps, beonrun.activityType, beonrun.mic, beonrun.chat, beonrun.tts, beonrun.chat.nickname, beonrun.pwa.installDismissedAt | BEON.RUN | necessary (functional) | settings you choose (GPS, activity type, microphone, chat, reading messages aloud, guest chat name, hiding the install prompt) | until deleted; cleared on sign-out and account deletion | browser storage |
| sessionStorage: beonrun.chat.nameSkipped | BEON.RUN | necessary | your "Just watching" choice in the chat | until the tab is closed | browser storage |
| IndexedDB "beonrun" | BEON.RUN | necessary | temporary queue of GPS points while offline | until sent or the Activity ends, max. 24 h | browser storage |
| Cache Storage "beonrun-…" | BEON.RUN | necessary | app (PWA) cache and offline page | until the app updates / is removed | browser storage |
| Cloudflare Turnstile (browser storage / strictly necessary Cloudflare cookies) | Cloudflare | necessary (security) | protects the Help / Support, sign-up and password reset forms against bots; the widget loads only on those pages, in "Managed" mode, without pre-clearance | for the verification (the token is valid for 5 minutes) | third party (challenges.cloudflare.com) |
Cloudflare Turnstile. On the pages with the Help / Support, sign-up and password reset forms we use Cloudflare Turnstile – a security mechanism that checks whether a form is sent by a person. Turnstile is not an analytics or advertising tool and does not depend on the statistics consent. Cloudflare processes technical signals (e.g. the IP address, the User-Agent header, browser information) and, according to its documentation, uses only strictly necessary browser storage. Details: Cloudflare Turnstile privacy policy.
Stripe. BEON.RUN does not embed Stripe scripts on its pages and does not set Stripe cookies. For payments, subscription management, support payments or identity verification we redirect you to Stripe's pages (checkout.stripe.com, billing.stripe.com, connect.stripe.com), where Stripe uses its own cookies and technologies needed for payments and fraud prevention, under Stripe's policy (https://stripe.com/cookie-settings).
We use Google Consent Mode v2 in basic mode: until you consent, Google's script is not loaded and no request is sent to Google. Advertising signals (ad_storage, ad_user_data, ad_personalization) stay off. Analytics runs only on selected public pages, never in the signed-in app or on Stream pages.
The necessary and functional mechanisms above do not require consent because they serve services you knowingly use.
§ 4. How to change or withdraw consent
- On your first visit to pages where analytics may run, we show a banner with three equal buttons: “Accept all”, “Necessary only” and “Settings”. Nothing is pre-selected.
- You can change your choice at any time via the “Cookie settings” link in the page footer. Withdrawing analytics consent deletes the _ga* cookies and switches Google Analytics off.
- You can also delete and block cookies in your browser settings. Blocking necessary cookies will prevent login.
- If analytics is disabled in the Service, the banner and the “Cookie settings” link are not shown and the Service uses necessary mechanisms only.
§ 5. Changes
If we add a new category or tool requiring consent, we will ask for it again. The Polish version is binding.