Cookie Policy
Last updated: 29 September 2026
Withdrawing takes effect immediately and deletes the analytics and advertising cookies already on this device. Nothing about the Service stops working if you refuse.
1. What cookies are
Cookies are small files a site stores on your device. Some are needed for the site to work at all; others exist so someone can measure or advertise to you. Only the first kind may be set without asking, which is why the rest sit behind the consent banner.
“Cookies” here also covers equivalent techniques such as local storage and tracking pixels, which the law treats the same way.
2. The three categories
2.1 Strictly necessary — always on
Signing you in, protecting the account, rate-limiting abuse, and remembering the cookie choice itself. These are exempt from consent under Article 5(3) of the ePrivacy Directive because the Service cannot be delivered without them. They carry no advertising value and are never shared for advertising.
2.2 Analytics — off until you say yes
Google Analytics 4 and PostHog, so we can see which pages and features actually get used and where people get stuck. PostHog runs on its EU cloud, so that data stays inside the EEA.
2.3 Marketing — off until you say yes
Google Ads, an X (Twitter) advertising pixel served through Google Tag Manager, Microsoft Advertising’s UET tag (the ads that run on Bing), and the Meta pixel of Meta Platforms Ireland Ltd (the ads on Facebook and Instagram), used to see which campaign brought someone here and — with the same consent — to show our ads again, on those platforms, to people who visited (retargeting). For the Meta pixel, Meta Platforms Ireland Ltd is joint controller with us for collecting that data here and passing it to Meta; the privacy policy says who answers for what. To be plain about it: this is advertising, measured and followed up, and it is the reason the banner asks you separately rather than lumping it in with analytics.
3. Every cookie we or our tools set
| Cookie | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| supershift-session | SuperHoreca | Keeps you signed in (JWT session token) | 7 days | Strictly necessary |
| supershift-cookie-consent | SuperHoreca | Remembers this cookie choice, so we stop asking | 1 year | Strictly necessary |
| theme | SuperHoreca | Remembers light/dark mode | 1 year | Strictly necessary |
| _ga | Distinguishes unique visitors | 2 years | Analytics | |
| _ga_* | GA4 session state per property | 2 years | Analytics | |
| _gid | Distinguishes visitors within 24 hours | 24 hours | Analytics | |
| _gat / _gat_* | Throttles the request rate | 1 minute | Analytics | |
| ph_* | PostHog | Product analytics — identifies a returning session (EU cloud) | 1 year | Analytics |
| _gcl_au | Google Ads | Attributes a signup to the ad that led to it | 90 days | Marketing |
| muc_ads, personalization_id | X (Twitter) | Advertising measurement and audience matching | up to 2 years | Marketing |
| _uetsid, _uetvid | Microsoft Advertising | Attributes a signup to the Microsoft (Bing) ad that led to it, and lets our ads reach you there again | 1 day / 13 months | Marketing |
| _fbp, _fbc | Meta Platforms Ireland Ltd | Attributes a signup to the Facebook or Instagram ad that led to it, and lets our ads reach you there again | 90 days | Marketing |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention on the payment form; set only when you open checkout | 1 year / 30 min | Strictly necessary |
Google Tag Manager sets no cookies itself; it loads the tags that do. Exact names and lifetimes are set by each provider and can change on their side — this table is reviewed whenever we add or remove a tool, and the banner asks again when that happens.
4. Guest pages carry no tracking at all
If you reached a booking form, a poll or a newsletter page through a restaurant or bar, you are that venue’s customer, not ours. We load no analytics or advertising code whatsoever on those pages — no Google, no PostHog, no pixels — so there is nothing to consent to and no banner to dismiss. Only the strictly necessary cookies apply.
5. Managing or withdrawing consent
Use the control at the top of this page, or the “Cookie settings” link in the footer of every page. You can change each category independently, and withdrawal is immediate — we also delete the analytics and advertising cookies already stored.
Your choice is remembered for one year. If we add or remove a tool, that choice no longer describes what we run, so we discard it and ask again rather than assuming your earlier answer still applies.
Independently of us, your browser can view, block and delete cookies, and Google offers an Analytics opt-out add-on that works across all sites. Blocking strictly necessary cookies will stop you being able to sign in.
6. Third-party policies
Where a cookie is set by someone else, their own policy governs what they do with it: Google, PostHog, Stripe, X, Microsoft, Meta. Who we share data with, and on what basis, is set out in the Privacy Policy and Subprocessors.
7. Changes to this policy
Updates are posted here with a new date. A change to which tools we run also resets the consent banner, so you get asked again instead of being bound by an answer you gave about something else.
8. Contact
Questions about cookies: info@superhoreca.app. Sidestream OÜ, Ahtri tn 12, 15551 Tallinn, Estonia (registry code 17374822).