Cookies
Last updated 30 Apr 2026
Cookie Policy
This Cookie Policy explains what cookies and similar technologies we use on korena.eu, why we use them, and how you can control them. It covers the korena.eu storefront only. Our Timber Index at timber-index.korena.eu is a separate site with its own privacy and cookies page. See section 5 below. It complements the Privacy Policy and is required by the EU ePrivacy Directive 2002/58/EC and the GDPR.
Cookie inventory verified against the storefront codebase on 2026-11-08 by static analysis. (Pre-launch: no automated scanner pass against a deployed Site has been performed yet; that re-verification is scheduled for first public launch.)
1. What cookies are
Cookies are small text files that a website places on your device when you visit. They are widely used to make websites work, to make them work more efficiently, and to provide information to the site owner. Throughout this Policy "cookies" includes other similar technologies such as localStorage, sessionStorage, web beacons, and pixel tags, where they perform a comparable function.
2. Categories of cookies we use
We classify the cookies on korena.eu into four categories, plus one non-identifying measurement cookie described in section 3.5:
- Strictly necessary: required for the Site to function (authentication, cart, checkout, security). These are set without prior consent under the ePrivacy Directive "strictly necessary" exception; they are necessary either for contractual necessity, legal obligation, or documented legitimate interests. Disabling them will break the Site.
- Preferences: remember choices you make to improve your experience (e.g., language). Set only on your explicit consent.
- Analytics: help us understand how visitors use the Site, in aggregate. Set only on your explicit consent.
- Marketing: used to deliver relevant advertising or measure marketing effectiveness across sites. We do not currently set any marketing cookies. This Policy will be updated before any marketing cookie is introduced.
- Source measurement (section 3.5): one first-party cookie that records which website or campaign sent you to the Site, with no identifier of you or your device. It is set without asking for consent and is not strictly necessary.
3. Cookie inventory
The table below lists every cookie we expect to set as of the date at the foot of this Policy. The live list is reconciled at every release.
This list was last reconciled by static analysis of the storefront codebase on 2026-11-08. An automated cookie-scanner pass against the deployed Site (Cookiebot or equivalent) is scheduled before first public launch; any deviation will be reflected here.
3.1. Strictly necessary
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
sb-<project-ref>-auth-token (chunked: …-auth-token.0, .1, …) | korena.eu (Supabase Auth via @supabase/ssr) | Holds your authenticated session (combined access + refresh token, JSON). Used for both admin sign-in and customer accounts. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 1 year (refresh-token-bearing); access token within is rotated ~hourly |
cart_session | korena.eu | UUID identifying your anonymous cart so items persist between visits and reservations stay tied to you through checkout. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 30 days |
korena_pwd_recovery | korena.eu | Short-lived marker set when you click an account password-reset link, so the reset form will accept a new password. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 10 minutes |
korena_review_claim | korena.eu | Set when you open a thank-you card or review code that belongs to an order (korena.eu/t/…), or when you confirm your order number and email there. It lets this browser submit the review of that one order without the emailed link. Signed; holds only the order and card identifiers. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 2 hours |
korena_site_gate_unlock | korena.eu | HMAC-signed token issued only when the site is in coming-soon / maintenance mode and you've entered the shared access password. Absent in normal operation. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 30 days |
korena_consent | korena.eu | Records your Consent Mode v2 choices (per category) and policy version, so the banner is not re-shown on every page. Mirrored in localStorage under korena.consent.v1. | First-party HTTP cookie, SameSite=Lax, Secure on HTTPS | 180 days |
__stripe_mid, __stripe_sid | Stripe (set when Stripe.js loads on the payment step of checkout) | Fraud prevention on payment. Stripe.js is loaded only on the payment step of the checkout flow, not site-wide. | Third-party HTTP cookie set by js.stripe.com | __stripe_mid 1 year, __stripe_sid 30 minutes |
3.2. Preferences
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
korena_store | korena.eu | Remembers your selected country store (e.g. bg) so we can route you to the right currency, VAT, and shipping setup on return. | First-party HTTP cookie, SameSite=Lax, Secure in production | 1 year |
korena_language | korena.eu | Remembers your chosen content language (e.g. en, bg). | First-party HTTP cookie, SameSite=Lax, Secure in production | 1 year |
korena_consent_vid | korena.eu | Random visitor identifier scoped to the consent log, so we can prove which device made which consent choice if challenged. | First-party HTTP cookie, SameSite=Lax, Secure on HTTPS | 180 days |
(localStorage) korena.consent.v1 | korena.eu | Mirror of the korena_consent cookie used by client-side code that prefers localStorage over cookies. Same data, same expiry. | Browser storage (not a cookie) | Until cleared |
3.3. Analytics
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
korena_vid | korena.eu | Pseudonymous visitor identifier (UUID v7) used to deduplicate first-party analytics events across sessions. Only written when you grant analytics consent. | First-party HTTP cookie, SameSite=Lax, Secure in production | ~13 months (395 days), refreshed on each visit |
korena_sid | korena.eu | Pseudonymous session identifier with a 30-minute sliding window. Only written when you grant analytics consent. | First-party HTTP cookie, SameSite=Lax, Secure in production | 30 minutes (sliding) |
korena_cid | korena.eu | Customer identifier set after newsletter signup, checkout, account login, or order lookup so we can attribute repeat events to the same person. Only written when you grant analytics consent. | First-party HTTP cookie, SameSite=Lax, Secure in production | ~13 months (395 days) |
korena_attr_first | korena.eu | First-touch attribution: serialised UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and click IDs (gclid, gbraid, wbraid, fbclid, ttclid, msclkid, li_fat_id, epik, ref) from the first visit that included them. Written once. Only with analytics consent. | First-party HTTP cookie, SameSite=Lax, Secure in production | 90 days |
korena_attr_last | korena.eu | Last-touch attribution: same shape as korena_attr_first, overwritten on every visit that includes a recognised attribution parameter. Only with analytics consent. | First-party HTTP cookie, SameSite=Lax, Secure in production | 90 days |
_ga | Google Analytics 4 (the Google tag, loaded through our Google Tag Manager container from metrics.korena.eu) | Random client identifier that lets Google Analytics count visitors and sessions and measure shop events (product views, cart, checkout, purchase). Only written when you grant analytics consent. | First-party cookie on korena.eu, written by JavaScript (not HttpOnly) | 2 years, renewed on each visit |
_ga_QQ7HZ5FJD8 | Google Analytics 4 (as above) | Keeps the session state (session number and start time) for our Google Analytics property. Only written when you grant analytics consent. | First-party cookie on korena.eu, written by JavaScript (not HttpOnly) | 2 years, renewed on each visit |
| (no cookie) Metricool page-view pixel | Metricool (tracker.metricool.com, loaded through our Google Tag Manager container) | On each page view, sends the page address, the referring page and your browser window size to Metricool, which we use to measure visits that come from our social media posts. Sets no cookie and stores nothing on your device; Metricool receives your IP address with the request. | Third-party image request, no cookie | Not stored on your device |
Alongside our own first-party analytics (the korena_* rows above), korena.eu loads Google Analytics 4 and the Metricool pixel through a Google Tag Manager container. The container and the Google tag are served first-party from metrics.korena.eu, our own server-side tagging server, which forwards the measurement data to Google. They are loaded on public shop pages only, not on sign-in, admin or partner pages. The Google tag follows Google Consent Mode v2: until you grant analytics consent (in the EEA, the UK and Switzerland it starts denied), it writes no _ga cookies and sends only cookieless pings without a client identifier, which Google uses for aggregate, modelled measurement. Earlier drafts of this Policy mentioned Plausible Analytics; that integration has not landed in code. If we add another third-party analytics tool we will list it here and re-prompt for consent.
Orders and Google Analytics. Your purchase is reported to Google Analytics once per order. If you granted analytics consent and our tag reports it from your browser, nothing else is sent. If the tag could not report it (for example it was blocked, or you closed the page), our server sends the order to Google Analytics instead through Google's Measurement Protocol: the order number, total, tax, shipping and the products. If you granted analytics consent at checkout, we also read your _ga cookies (we do not set them) and store the Google Analytics client and session identifiers on the order, so the sale is counted against the visit that led to it. Without your consent we store no such identifier and send the order as an anonymous revenue record, with no IP address, device data, name, e-mail or phone number.
Our Timber Index at timber-index.korena.eu uses the same Google Tag Manager container, reporting to a separate Google Analytics property, after that site's own consent prompt. It is a separate host with a separate consent choice and separate cookies. See section 5.
3.4. Marketing
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
| Google Funding Choices ("Privacy & Messaging") cookies | fundingchoicesmessages.google.com | Loaded only for visitors in the EEA, UK, or Switzerland, only when NEXT_PUBLIC_GOOGLE_CMP_ENABLED=true and a Google publisher ID is configured. Google's CMP renders the consent message and may set cookies under its own policies. Currently disabled by default. | Third-party cookies set by Google | Per Google's policy |
No other marketing/advertising cookies are set today. There is no Facebook Pixel, no LinkedIn Insight, no TikTok Pixel and no Google Ads tag. The Google Tag Manager container on korena.eu carries only the Google Analytics 4 and Metricool tags listed in §3.3, and neither is used for advertising. The Google Consent Mode v2 default-state script (gtag('consent','default',…)) is emitted server-side before Google Tag Manager loads, so the Google tag starts in the consent state that applies to you. Emitting that inline script does not by itself set any cookie.
3.5. Source measurement (set without consent)
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
korena_src | korena.eu | Records which website or campaign sent you to the Site: the host name of the referring website, the first page you landed on (without any query string) and the campaign tags utm_source, utm_medium, utm_campaign, utm_content and utm_term if the link carried them, for your first and your most recent such visit, with the date. It contains no identifier of you or your device, no advertising click IDs, no IP address and no full referring address. If you place an order, a copy of the same data is stored with that order so we can tell which channels (search engines, AI assistants, social media, email, other websites) bring orders. It is not shared with anyone and not used for advertising or profiling. | First-party HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | 30 days |
This cookie is set without asking for your consent, and we do not describe it as strictly necessary: it is not needed for the Site to work. We set it on the basis of our legitimate interest in knowing which channels bring orders, and it holds no identifier. You can delete it in your browser at any time; blocking it does not affect the Site.
4. Consent
When you first visit korena.eu, the consent banner asks you to choose between:
- Accept all: strictly necessary + preferences + analytics + (if any) marketing.
- Reject all: strictly necessary only. The non-identifying source cookie in section 3.5 is not controlled by this choice.
- Customise: choose categories individually.
Reject-All is presented with the same prominence as Accept-All; we do not use cookie walls, dark patterns, or other "consent fatigue" friction. Your choice is recorded in the korena_consent cookie and respected on every subsequent visit until you change it.
We retain a timestamped record of every consent decision (timestamp, banner version, anonymised IP class, and your choices) for 12 months from the decision date. This record is retained as evidence in case of a later dispute about whether and when you gave consent.
You can change your choice at any time via the "Cookie settings" link in the footer.
5. Third-party cookies and processors
Some cookies are set by third parties when you use specific functionality on the Site. They are documented in §3 above. We have reviewed each third party and consider their use proportionate to the function they provide. Third parties that set their own cookies act as independent or joint controllers for those cookies; their privacy policies apply in addition to ours:
- Stripe (payment processing): stripe.com/privacy. Stripe sets fraud-prevention cookies during checkout and is a data processor on our behalf for payment data.
- Google (Google Analytics 4, through Google Tag Manager): policies.google.com/privacy and how Google uses information from sites that use its services. The Google tag writes the
_gacookies listed in §3.3 once you grant analytics consent; our tagging server atmetrics.korena.euforwards the measurement data to Google. - Metricool (social media and website traffic measurement): metricool.com/privacy-policy. Its pixel sets no cookie; it receives the page address, the referring page, your browser window size and your IP address.
We do not embed any other third-party scripts that set cookies (no Facebook Pixel, no LinkedIn Insight, no TikTok Pixel, no Google Ads tag) on korena.eu at the date at the foot of this Policy.
Our Timber Index subdomain has its own consent. timber-index.korena.eu loads Google Analytics 4 through the same Google Tag Manager container, served first-party from metrics.korena.eu, into a separate Google Analytics property, and only after the visitor accepts on that site. It sets _ga cookies for analytics measurement. That site is covered by its own privacy and cookies page; the consent you give (or refuse) there is recorded separately from your choice here, and neither carries over to the other.
6. How to manage cookies in your browser
In addition to the in-Site cookie controls, every modern browser lets you manage cookies through its settings. The exact path varies by browser; the documentation pages below are kept up to date by the respective vendors:
- Chrome: support.google.com/chrome/answer/95647
- Safari: support.apple.com/guide/safari/manage-cookies-sfri11471
- Firefox: support.mozilla.org/kb/cookies
- Edge: support.microsoft.com/microsoft-edge
Blocking strictly necessary cookies will prevent the Site from working. In particular, you will not be able to sign in or check out. Where a browser sends a Global Privacy Control (GPC) signal, we treat it as a Reject-All choice for analytics and marketing categories. The deprecated Do-Not-Track (DNT) header is treated equivalently where present.
7. Changes to this Policy
We update this Policy whenever the cookie inventory changes. The cookie consent banner is re-shown to you whenever a new category is introduced or a material new third party is added.
8. Languages
This Policy is authored in English. Translations may be made available on the Site. Where required by law (notably for Bulgarian-resident visitors), the Bulgarian translation is the binding version.
Appendix A: Consent banner copy (English)
This is the canonical wording for the consent banner. It is reproduced here so legal review and translation can happen alongside this Policy.
Banner
Cookies on korena.eu We use strictly necessary cookies to make this site work. With your consent, we also use a small set of preference and analytics cookies to improve the site. We don't use marketing or advertising cookies. [ Reject all ] [ Customise ] [ Accept all ] See our Cookie Policy and Privacy Policy.
Customisation panel labels
Strictly necessary: always on. Required for sign-in, cart, and checkout. Preferences: toggle. Remember your language and display choices. Analytics: toggle. Help us understand how the site is used, in aggregate, without tracking you individually. Marketing: (not used)
[ Save my choices ]
Appendix B: Consent banner copy (Bulgarian)
Bulgarian translation pending sworn translator. Both English and Bulgarian versions will be offered to Bulgarian-resident visitors at point of first visit, as required by Article 49 of the Bulgarian Consumer Protection Act.
Last reviewed: 2026-04-30 · Next review: 2027-04-30 (or earlier on trigger).