Cookies and local storage

Last updated: 21 October 2026

A bar at the bottom of every page asks you to choose: Necessary only, or Accept all. Article 5(3) of the ePrivacy Directive requires consent before anything is stored on or read from your device — with one exception, for storage strictly necessary to provide the service you asked for. Sections 1 and 2 sit inside that exception. Section 4 — the measurement tags — does not, so it loads only after Accept all. There is no social widget, no embedded video, no chat box, and the typefaces are served from this domain.

Necessary only, or Accept all. Either button opens signing in, creating an account and Continue with Google; until you press one, those stay off. Necessary only is the site with nothing measuring: reading it makes no request to any other domain, and three outside services load only when you use them (section 3). Accept all adds the measurement in section 4. Your choice is remembered only for this visit (datum-cookie, section 2) — every time you open the site again, the bar asks again. Cloudflare's protection cookies (section 1) are set by the host before a page reaches you, and neither button changes them.

Change your choice Brings the bar back, withdraws Accept all if you gave it, and deletes the measurement cookies from section 4.

1. Cookies the site needs

All strictly necessary, none of them about you. They are set whichever button you press.

Cookie	What it is for	How long
datum_session the sign-in session, set by our licence server	Set only when you sign in to a DATUM account. It is what keeps you signed in from one page to the next, and it is the only thing that proves a request to see your own licence keys is coming from you. It is a random value; the server keeps only a hash of it. HttpOnly, Secure and SameSite=Lax, so it cannot be read by a script or sent with a request from another site. Signing out deletes it and ends the session on the server. If you never open an account, it is never set.	30 days, or until you sign out
datum_google set by our licence server	Only when you press “Continue with Google”. It carries the sign-in across the trip to Google and back — random values that prove the answer coming back belongs to the sign-in you started — and is deleted the moment you return. HttpOnly, Secure, SameSite=Lax, and sent only to the Google sign-in address on this site.	10 minutes at most
datum_preview	Only for the site's owner, while editing the site's text. It shows the unpublished draft instead of the live page, holds the value 1 and nothing else, and an ordinary visitor never receives it.	2 hours
__cf_bm, cf_clearance set by Cloudflare, which hosts this site	Bot protection. Cloudflare serves every page here, and on this domain it sets these to tell people from automated traffic that floods or scrapes a site. They are made for this site alone, carry no user ID, are not used to follow you to other sites and are not read by us. See Cloudflare's cookie reference.	Short-lived; __cf_bm ends after 30 minutes without activity

With Necessary only, that is the complete list of cookies on this domain. Authentication and protection against abuse are the textbook examples of strictly necessary storage, and none of these is used for any purpose beyond the one described. The outside services in section 3 may set their own when you use them, and Accept all adds those in section 4.

2. What is kept in your browser's local storage

Local storage is not a cookie — it is never sent to a server, and we cannot read it. It stays on your device, readable only by pages on this domain, and clearing your browser data removes all of it. The same Article 5(3) applies to it, and the same exception covers it: every one of these exists so the site works the way you left it.

Key	What it holds
datum-theme	Light or dark
datum-lang	Which language you chose for the site — English, German, French or Italian
datum-cur	Which currency you chose to read prices in
datum-vat	Whether prices are shown with or without VAT
datum-cart, datum-cart-items	What is in your cart, until you check out
datum-cart-x	That you closed the reminder about an unfinished order. Kept only until you close the tab (session storage).
datum-account-email	The address you last signed in with, so the field is filled in for you. Not the password, and not the session — the session is the cookie above.
datum-user, datum-library	A local copy of what you have bought, so the account page has something to show before the server answers
datum-recent	The last six products you looked at, to put them back on your account page
datum-votes	Which roadmap items you marked. It stays in this browser; it does not reach us.
datum-promo, datum-cd-x	That you dismissed a promotion or a countdown, so it stops coming back
datum-cookie	Which button you pressed in the cookie bar — Necessary only or Accept all. Kept only until you close the tab (session storage), so the bar asks again on every visit. Until it is there, the bar is shown, signing in is switched off and nothing measures.

None of these identifies you, none is sent anywhere, and none is joined to anything else. datum-cookie records only which button you pressed, for this visit; close the tab and the bar comes back.

3. Outside services that load only when you use them

None while you read, unless you chose Accept all (section 4). Otherwise opening and browsing any page here makes requests to this domain and to no other. These load only when you do something that needs them:

Service	When it loads, and why
Cloudflare Turnstile challenges.cloudflare.com	Only when you open a form that sends us something — the question box, Write us, an order by e-mail, or joining the notification list. It checks that the sender is a person and not a script, so that the forms cannot be used to flood us or anyone else with mail. It is security for the service you are using, not tracking, and it does not show ads or follow you to other sites. See Cloudflare's Turnstile privacy addendum.
Google accounts.google.com	Only when you press Continue with Google on the account page. You are sent to Google's own sign-in page, where Google's cookies and Google's policy apply, and Google sends you back here with your e-mail address and nothing else. Nothing from Google loads on the pages of this site. See Google's privacy policy.
Stripe js.stripe.com and other stripe.com addresses	Only on the checkout page, when you pay. Stripe's card form is embedded in that page, so your card details go straight to Stripe and never reach us. Stripe may set its own cookies there (for example __stripe_mid and __stripe_sid) to prevent fraud, which is part of taking a payment safely. See Stripe's cookie policy.

All three are strictly necessary for the thing you asked for — sending a message, signing in with Google, or paying — and none loads on any other page or for any other purpose.

The typefaces used to come from Google Fonts, so every visitor's browser handed their IP address to Google before the first word was drawn. A German court held that to be an unlawful transfer of personal data where the visitor had not consented (Landgericht München I, 20 January 2022, 3 O 17493/20). The fonts are now served from this domain, which removes the request rather than disclosing it.

4. Measurement — only after Accept all

Three tags, loaded only once you press Accept all, and only for that visit. They tell us how many people visit, which of our ads on Instagram and Google brought them, and whether those people then created an account, joined the notification list, downloaded the plugin, opened a checkout or paid. They never receive your password, your card or your e-mail address.

Tag and cookies	What it is for	How long
Cloudflare Web Analytics static.cloudflareinsights.com no cookie	Counts page views, where visitors came from and how fast pages load. It sets no cookie and keeps no identifier for you. See Cloudflare Web Analytics.	—
Meta Pixel connect.facebook.net _fbp, _fbc	Tells Meta that a visitor from one of our Instagram ads arrived, signed up or bought, so that we can see which ads work and Meta can show them to similar people. _fbp is a random browser identifier; _fbc is set only when you arrive from a Meta ad. Meta and we are joint controllers for this collection; see Meta's privacy policy.	90 days
Google tag (Google Analytics, Google Ads) www.googletagmanager.com _ga, _ga_…, _gcl_au	Counts visits and tells Google Ads which of our ads led to a sign-up or a sale. _ga and _ga_… are random identifiers for Google Analytics; _gcl_au links a visit to the ad that brought it. See how Google uses data from sites that use its services.	_ga, _ga_…: 2 years; _gcl_au: 90 days

Change your mind at any time: Change your choice at the top of this page, or close the tab — the bar asks again on the next visit and nothing loads until you answer. Withdrawing deletes the cookies above from this domain; what was already sent stays with Meta and Google under their policies, and you can ask them, or us, about it.

The Content-Security-Policy in _headers allows these three tags' hosts and nothing else from outside beyond section 3, so anything not listed on this page would simply fail to load rather than silently start collecting. A policy is a promise, and a header is what keeps it.

5. Controlling it yourself

Every browser can block or clear cookies and site data, per site or altogether, and you do not need our permission to do it. Meta's and Google's own ad settings also let you limit what they do with it. Clearing this site's data resets your theme, currency and cart, and signs you out. Nothing else is lost, because there is nothing else.

6. Changes

If this page changes, the date at the top changes with it.

7. The rules this page follows

• Directive 2002/58/EC (ePrivacy), Article 5(3), as amended by Directive 2009/136/EC
• Закон за електронните съобщения, чл. 4б
• Regulation (EU) 2016/679 (GDPR), Articles 6 and 13
• EDPB Guidelines 2/2023 on the technical scope of Article 5(3) ePrivacy

See also the Privacy policy, which covers what happens to data once it reaches us, and the company details for who "us" is.