Cookies and storage
The app uses sign-in, security and language preference features. Technical logs and simple usage counters do not add analytics cookies or external advertising pixels.
Updated: 2026-09-25
Sign-in and security cookies
tembunar_session: random session identifier, maximum 30 days, HttpOnly and SameSite=Lax; HTTPS only in production. Set after successful sign-in and removed on sign-out.
tembunar_wichtel_guest: random access identifier for expressly requested account-free gifting-group participation, maximum one year, HttpOnly and SameSite=Lax, and Secure in production. The server stores only its hash as a membership identifier. It applies to the same browser and is not used for advertising or cross-device tracking.
tembunar_oauth: binds an explicitly started Google/Apple sign-in attempt, maximum 10 minutes, HttpOnly and Secure; SameSite=Lax for Google and SameSite=None for Apple. Used within the OAuth flow and removed afterwards.
These cookies support the expressly requested sign-in service and its security, under section 25(2)(2) TDDDG. Personal data processing is also governed by the GDPR bases described in the privacy policy.
Your language preference
tembunar_language stores only auto, de, en, fr, es or pt, for up to one year, HttpOnly and SameSite=Lax, with Secure in production. It remembers the language you choose or the Automatic mode and is set when saving that preference or signing in. For signed-in users, the preference is also saved with the account. It contains no location or tracking identifier.
Automatic mode uses the browser's preferred language. No precise location permission or IP geolocation is requested. You can change this preference at any time.
No blanket tracking consent
No marketing-cookie banner is displayed for exclusively necessary service functions. This exception does not automatically apply to every security, analytics or third-party tool. Additional features must be assessed and, where required, use meaningful consent with an equally accessible refusal option.
Where enabled and opened, Cloudflare Turnstile and social sign-in are described separately in the privacy policy. Retailers, PayPal and WhatsApp are responsible for cookies on their own pages.
Your control
You can sign out and delete cookies in your browser. Public information pages work without a session cookie; signed-in wishlist features require a session.