Cookie 政策
- 版本:
- 1.4
- 生效日期:
- 26.10.2026
- 发布日期:
- 26.10.2026
本文件提供英文版本。具有约束力的版本为波兰语版和英语版。
This English translation is provided for information only. The Polish version is the binding version.
This Policy explains which cookies and other device storage technologies are used by the BEON.RUN service (https://beon.run), operated by Radosław Balcerzak, balcerzak.it RADOSŁAW BALCERZAK, NIP 7631978291. The processing of personal data is described in the Privacy Policy.
§ 1. What cookies and browser storage are
Cookies are small text files saved by your browser. The Service also uses browser storage (localStorage, sessionStorage, IndexedDB, Cache Storage). Under Article 399 of the Polish Electronic Communications Law of 12 July 2024, storing information on your device or accessing it requires your consent unless it is necessary to provide a service you have explicitly requested or to transmit a communication.
§ 2. Categories
- Necessary - always on; the Service does not work without them (login, security, remembering your cookie choice, features you knowingly use). No consent is required.
- Analytics - Google Analytics 4; only with your consent.
- Marketing - Google Ads conversion measurement; only with consent. We only check whether a visit from a BEON.RUN ad ended in an Account sign-up or a visit to the App Store. We use no remarketing or ad personalisation, and the Service in the browser shows no ads.
§ 3. Cookies and browser storage in use
This list is based on the cookies actually set in the browser (as of the version date of this document).
| Name | Provider | Category | Purpose | Duration | Type |
|---|---|---|---|---|---|
| PHPSESSID | BEON.RUN | necessary | sign-in and form session | until the browser is closed; the session ends after 30 min of inactivity or 48 h after sign-in | first-party, HttpOnly |
| REMEMBERME | BEON.RUN | necessary | automatic sign-in - only if you tick "Remember me" | 30 days | first-party, HttpOnly |
| mercureAuthorization | BEON.RUN | necessary | authorises real-time events for signed-in users (chat, GPS, notifications) | 1 hour, renewed | first-party, HttpOnly |
| __Host-csrf-token_… | BEON.RUN | necessary | protects forms against CSRF attacks | one-time, until the form is sent | first-party |
| bor_consent | BEON.RUN | necessary | remembers your cookie decision | 6 months | first-party |
| locale | BEON.RUN | necessary (functional) | remembers the language you chose manually (pl/en) | 12 months | first-party, HttpOnly |
| __cf_bm, _cfuvid, cf_clearance and other Cloudflare cookies | Cloudflare | necessary | protection against automated traffic and attacks - set only when the relevant Cloudflare protection feature is enabled (e.g. bot protection, rate limiting, browser challenge); on the date of the check (29.09.2026) beon.run pages set no Cloudflare cookies | __cf_bm - expires after 30 minutes of inactivity; others - according to Cloudflare's rules | set by the infrastructure provider |
| _ga | Google (Google Analytics 4) | analytics - only with consent | distinguishes visitors | up to 2 years (some browsers cap it at 400 days) | on the beon.run domain, written by Google's script |
| _ga_<id> | Google (Google Analytics 4) | analytics - only with consent | keeps the analytics session state | up to 2 years (some browsers cap it at 400 days) | as above |
| _gcl_au, _gcl_aw (and related _gcl_*) | Google (Google Ads) | marketing - only with consent | remembers the ad click identifier (gclid) and attributes a sign-up or App Store visit to an ad campaign | up to 90 days | own beon.run domains, written by Google's script |
| bor_ads_click | BEON.RUN | marketing - only with consent | remembers the Google Ads click identifier (gclid, gbraid or wbraid) from the address of the page you reached from an ad, so that after sign-up a later Plan purchase can be attributed to the campaign (§ 8 of the Privacy Policy) | 90 days | first-party |
| localStorage: beonrun.gps, beonrun.activityType, beonrun.mic, beonrun.chat, beonrun.tts, beonrun.chat.nickname, beonrun.pwa.installDismissedAt | BEON.RUN | necessary (functional) | settings you choose (GPS, activity type, microphone, chat, reading messages aloud, guest chat name, hiding the install prompt) | until deleted; cleared on sign-out and account deletion | browser storage |
| sessionStorage: beonrun.chat.nameSkipped | BEON.RUN | necessary | your "Just watching" choice in the chat | until the tab is closed | browser storage |
| IndexedDB "beonrun" | BEON.RUN | necessary | temporary queue of GPS points while offline | until sent or the Activity ends, max. 24 h | browser storage |
| Cache Storage "beonrun-…" | BEON.RUN | necessary | app (PWA) cache and offline page | until the app updates / is removed | browser storage |
| Cloudflare Turnstile (browser storage / strictly necessary Cloudflare cookies) | Cloudflare | necessary (security) | protects the Help / Support, sign-up and password reset forms against bots; the widget loads only on those pages, in "Managed" mode, without pre-clearance | for the verification (the token is valid for 5 minutes) | third party (challenges.cloudflare.com) |
Cloudflare Turnstile. On the pages with the Help / Support, sign-up and password reset forms we use Cloudflare Turnstile - a security mechanism that checks whether a form is sent by a person. Turnstile is not an analytics or advertising tool and does not depend on the statistics consent. Cloudflare processes technical signals (e.g. the IP address, the User-Agent header, browser information) and, according to its documentation, uses only strictly necessary browser storage. Details: Cloudflare Turnstile privacy policy.
Stripe. BEON.RUN does not embed Stripe scripts on its pages and does not set Stripe cookies. For payments, subscription management, support payments or identity verification we redirect you to Stripe's pages (checkout.stripe.com, billing.stripe.com, connect.stripe.com), where Stripe uses its own cookies and technologies needed for payments and fraud prevention, under Stripe's policy (https://stripe.com/cookie-settings).
We use Google Consent Mode v2 in basic mode: until you consent, Google's script is not loaded and no request is sent to Google. The advertising signals ad_storage and ad_user_data are switched on only after consent to the “Marketing” category; ad_personalization always stays off. Analytics and the Google Ads tag run only on selected public pages, never in the signed-in app or on Stream pages. The single exception is the sign-up itself: if you gave marketing consent, the first page after registration sends Google Ads a “sign-up” event under the placeholder address /welcome - without the real page address, e-mail, name or other Account data.
The necessary and functional mechanisms above do not require consent because they serve services you knowingly use.
§ 4. How to change or withdraw consent
- On your first visit to pages where analytics may run, we show a banner with three equal buttons: “Accept all”, “Necessary only” and “Settings”. Nothing is pre-selected.
- You can change your choice at any time via the “Cookie settings” link in the page footer. Withdrawing analytics consent deletes the _ga* cookies and switches Google Analytics off; withdrawing marketing consent deletes the _gcl_* cookies and switches Google Ads measurement off.
- You can also delete and block cookies in your browser settings. Blocking necessary cookies will prevent login.
- If analytics is disabled in the Service, the banner and the “Cookie settings” link are not shown and the Service uses necessary mechanisms only.
§ 5. Changes
If we add a new category or tool requiring consent, we will ask for it again. The Polish version is binding.