Cookie and local storage notice
Unofficial English translation, for information only. The binding text is the Hungarian Süti- és helyitárhely-tájékoztató (version 2026-09-09). In case of any difference, the Hungarian text prevails. All legal documents in English
Version: 2026-09-09. Applicable to new contracts from this date, with express acceptance. Amendments to an existing subscriber’s contract are governed by point 15 of the GTC and by the separate effective date specified in the prior notice.
1. What FoglalGo uses
Cookies and browser storage store data on the device. sessionStorage is session storage bound to the given website and browser tab; localStorage is more persistent and may remain until it is deleted separately. Short storage does not in itself mean exemption from consent.
| Name | Type | Where | Purpose | Lifetime | Legal category |
|---|---|---|---|---|---|
munkamenet |
session cookie (HttpOnly, Secure, SameSite=Lax, Path=/; without Max-Age and Expires) |
the browser sends it with every foglalgo.com request (Path=/), but only the admin/dashboard endpoints use it |
identifying the logged-in business session | browser session; from the Budapest midnight following the day of login the server no longer accepts it, and on logout it invalidates it immediately | strictly necessary — no consent needed |
foglalo-tema |
sessionStorage | the old admin interface and the demo admin of the showcase | remembering the light/dark theme chosen by the user | until the end of the browser tab session | display setting requested by the user |
foglalo-stilus |
sessionStorage | the old admin interface and the demo admin of the showcase | remembering the display style chosen by the user | until the end of the browser tab session | display setting requested by the user |
foglalgo-tema |
sessionStorage | the dashboard (new admin interface) | remembering the light/dark theme chosen by the user | until the end of the browser tab session | display setting requested by the user |
foglalgo-paletta |
sessionStorage | the dashboard (new admin interface) | remembering the colour palette chosen by the user | until the end of the browser tab session | display setting requested by the user |
foglalgo-ertesites-olvasva (for the super-admin, when viewing another business: foglalgo-ertesites-olvasva-<business-id>) |
sessionStorage | the dashboard (new admin interface) | the “read up to here” marker of the dashboard’s notification bell | until the end of the browser tab session | remembering the requested notification function |
uj-admin-foglalas-vendeg |
sessionStorage | the dashboard (new admin interface) | handing over the guest’s name, e-mail address and phone number from the guest list to the new booking form | deleted when the form first reads it, at the latest when the browser tab is closed | strictly necessary for the requested function — no consent needed |
uj-admin-foglalas-idopont |
sessionStorage | the dashboard (new admin interface) | handing over the selected date from the calendar to the new booking form | deleted when the form first reads it, at the latest when the browser tab is closed | strictly necessary for the requested function — no consent needed |
cf_clearance |
Cloudflare security cookie | depends on the check applied | remembering the result of the check | configured Challenge Passage: 30 minutes; on the pages measured, we did not observe the cookie being issued or its actual expiry | security storage tied to the check applied; the setting is not the lifetime of every Cloudflare storage item |
cf.turnstile.u |
third-party localStorage | the origin of the challenges.cloudflare.com Turnstile iframe; present on the three public pages measured |
identifier related to a Cloudflare bot protection operation | no built-in browser expiry; may remain until deleted by the user, the browser or the provider; no specific provider TTL has been confirmed | third-party bot protection storage; the 30-minute Challenge Passage is not its lifetime |
According to the local source code, the theme, style, palette and notification read marker also live in sessionStorage. The two short form handover items remain there as well and are deleted when first read. FoglalGo’s own active application code does not write to localStorage; the loaded Cloudflare iframe, however, does.
The browser-side expiry of the session cookie may also be affected by the browser’s session restore. The server-side limit is independent of this: from the Budapest midnight following the day of login, the session is invalid. sessionStorage is not tied to that midnight or to logout, but to the browser tab session; when a browser session is restored, the data may be restored too. The form handover data are deleted when first read.
The own code of the guest booking interface does not write localStorage or sessionStorage data and does not set its own cookie. This does not exclude Cloudflare storage or the sending of a previously set session cookie for the same domain. When embedded, the operator of the host website provides information about that website’s own storage.
2. Cloudflare bot protection
Cloudflare Turnstile is loaded from challenges.cloudflare.com; bot protection may involve processing the IP address and technical characteristics of the browser. The legal basis for FoglalGo’s own processing for abuse prevention is legitimate interest under Article 6(1)(f) GDPR. The consent conditions for storage on terminal equipment must be examined separately from this.
cf_clearance may store the result of the bot check. Its validity is affected by Cloudflare’s current setting and the type of check. We do not present the provider’s default value as FoglalGo’s actual storage period. The HttpOnly attribute restricts access by the page’s JavaScript; it does not make the data non-personal.
According to the logged-in Cloudflare check of 2026-09-08, the Challenge Passage is 30 minutes, Bot Fight Mode is on and Precursor is off. In a fresh, empty browser environment, no cookie appeared in an 8-second sample of the three public pages examined. There were no localStorage data on the main origin; on the login page, the theme/style sessionStorage mentioned above was present. The challenges.cloudflare.com iframe stored cf.turnstile.u localStorage data on all three pages. We did not read or save the value. This is a dated sample, not general evidence that every page and browsing session is free of cookies or storage.
3. When is consent required?
Under Article 5(3) of the ePrivacy Directive, storage necessary for the transmission of a communication, or strictly necessary to provide a service explicitly requested by the user, may be exempt from prior consent. Session identification and remembering the requested display setting for the session may be used tied to this purpose. Calling something “security” or “convenience” storage does not in itself give an exemption; the purpose, scope and necessary duration must also be examined.
The current interface has no general consent banner. This is an operational fact, not proof that the entire live system is exempt from consent. Full evidence of the specific provider expiry of the third-party Turnstile storage and of the strictly necessary duration is not available; we do not derive a general exemption from consent from it. Unnecessary storage must be avoided, and storage requiring consent may only start after an appropriate prior choice. Reading this notice or continuing to use the website does not replace consent.
4. Advertising and analytics tracking
In the shared source checked on 2026-09-08, a targeted search found no Google Analytics, Meta advertising or similar general analytics loader. This is not a complete measurement of the live network traffic or browser storage. Before any new measurement code, information must be given about the specific data, provider, purpose and duration, and any operation requiring consent may only start with prior consent. Under the salon’s processing mandate, FoglalGo may not use guest booking data for its own advertising purposes.
The shared source also contains a conditional Barion basic Pixel: if the salon has a suitable Barion connection and it is switched on separately, browser/device data and a cookie identifier may reach Barion Payment Zrt. on the booking or payment page for fraud prevention purposes. FoglalGo’s module does not pass on marketing consent; this alone does not prove that all of the provider’s operations are exempt from consent. In the live public configuration of 2026-09-08, BARION_PIXEL_AKTIV is not switched on, and the loading gate that requires the value true is closed. This is a dated operational state. Before activation, checking the scope of data, the storage period and the legal basis, as well as the necessary prior choice, is a condition for putting the information and the function concerned live. Barion privacy notice.
5. How can the stored data be managed and deleted?
- Cookies and site data can be viewed and deleted in the browser’s privacy settings. After the session cookie is removed, you have to log in again for protected admin operations; for server-side closure, use Log out.
- sessionStorage lives until the end of the browser tab session, subject to the browser’s restore behaviour. Deleting site data also removes any old localStorage settings that may remain. The theme and palette may then return to their default values, and the notification read marker and the form handover may be lost.
- Deleting or blocking the Cloudflare cookie may result in a new bot check; blocking the storage needed for the security check may also prevent access.
Sources and contact
- ePrivacy Directive, Article 5(3)
- WP29 Opinion 04/2012, in particular 3.2–3.3. and 3.6.
- Cloudflare cookie documentation — Challenge Passage, documentation and separate account check: 2026-09-08; the setting is not evidence of actual cookie issuance.
- Privacy notice.
Operator: Megyeri Magor, sole trader. Data protection contact: info@foglalgo.com.
English translation of the Hungarian version of 2026-09-09. Page last updated: .