1. What is a cookie?
A cookie is a small record stored by your browser and attached to requests for the relevant website according to the browser's rules. A session cookie has no persistent expiry date; the browser's session restoration settings can affect how long it remains. A persistent cookie has an expiry time.
sessionStorage is different: it belongs to a browser tab and is not automatically attached to every HTTP request. Whether a technology is necessary depends on its purpose, not on whether it is called a cookie or another kind of storage.
2. Necessary operation
The session and CSRF protection support the form process you request and keep it secure. Our preference cookie is needed to respect your decision even when you reject measurement. It is not itself an analytics or advertising identifier.
Necessary operation does not require permission through the optional measurement checkboxes. You can delete or block necessary cookies in your browser too, but doing so may interrupt form completion or submission.
reCAPTCHA security storage — amendment, 2026-11-03
Enquiry forms use Google reCAPTCHA Enterprise for spam verification. Its code loads on the contact page and at the final planner submission; earlier planner steps do not require a CAPTCHA. This necessary form security check is independent of marketing or analytics consent and does not change those choices.
Google may use a security cookie and browser storage for reCAPTCHA, including the _GRECAPTCHA or _grecaptcha identifier. Actual storage, domain and expiry depend on Google's service and your browser; you can inspect and remove them in your browser's site-data controls. The CAPTCHA token is separate: it is single-use, valid for up to two minutes, and AppNova does not store it as enquiry data. Blocking the necessary security code or storage may prevent submission.
Further information: Google reCAPTCHA, Google Cloud terms, Data Processing Addendum. Amendment version: recaptcha-checkbox-v1-2026-11-03.
3. Inventory of our own cookies
The provider is the controller. The cookies use HttpOnly and SameSite=Lax; Secure is used with HTTPS. The session and preference cookies apply under the application's path; the CSRF cookie uses the application's web root. With a subdirectory installation, this also follows the application prefix. No external cookie domain is configured.
APPWEBPAGE_SESSION
| Property | Description |
|---|---|
| Service provider | Prognovum System Kft. |
| Purpose | Continuing your form completion and session. |
| Category | Necessary |
| Stored information | A random session identifier; answers are held on the server, not in the cookie. |
| Duration | Session cookie without an explicit browser expiry time. The server-side session inactivity limit is 120 minutes. |
| Legal basis | GDPR Article 6(1)(b): steps taken at your request before entering into a contract. |
| Access | The AppNova application server; HttpOnly, not readable by JavaScript. |
| Erasure and withdrawal | Can be deleted in your browser; you may lose continuity of the process. |
| Necessary / optional | Necessary |
appwebpage_csrf
| Property | Description |
|---|---|
| Service provider | Prognovum System Kft. |
| Purpose | Protecting forms against submissions initiated by another website. |
| Category | Necessary |
| Stored information | A random, validated security token, not the contents of the form. |
| Duration | Session cookie without an explicit browser expiry time. |
| Legal basis | GDPR Article 6(1)(f): the legitimate interest in keeping the website secure and preventing abuse, limited to necessary and proportionate processing. |
| Access | The AppNova application server; HttpOnly, not readable by JavaScript. |
| Erasure and withdrawal | Can be deleted in your browser; a fresh page and token are required for another submission. |
| Necessary / optional | Necessary |
appwebpage_measurement
| Property | Description |
|---|---|
| Service provider | Prognovum System Kft. |
| Purpose | Remembering accepted or rejected measurement choices; not itself a tracking cookie. |
| Category | Necessary |
| Stored information | Signed preference: random identifier, revision, version, a yes/no choice per purpose and expiry. It contains no name, email address or click identifier. |
| Duration | 180 days from saving the choice; a change sets a new expiry. |
| Legal basis | GDPR Article 6(1)(f): respecting and demonstrating your choice. The preference cookie is necessary; optional measurement requires separate consent. |
| Access | The AppNova application server; HttpOnly, not readable by JavaScript. |
| Erasure and withdrawal | Can be changed in Measurement settings. It remembers rejection too and can be deleted in the browser. Deleting the cookie alone does not erase the server-side evidence. |
| Necessary / optional | Necessary |
Expiry and physical erasure are different operations. Server-side preference evidence, a session file and a browser cookie are separate records; the Privacy Policy explains their retention separately.
4. Demo browser storage
The two demos keep their runs separately in sessionStorage: appnova.demo.v1.customer_return_v1 and appnova.demo.v1.field_service_v1. This holds the version, local run identifier, screen, simulated command history and identifiers of milestones already reported. Text entered in a demo notes field may also be part of the local run; do not enter personal or confidential information.
The data belongs to the browser tab's session and has no separately assigned persistent expiry. It helps you continue after refreshing; browser restoration settings may affect how long it remains. Confirming a restart affects only that story's run. You can also remove it using your browser's site-data controls.
Demo storage does not send its command history to analytics. Only the separately reviewed feature choices and your own requirements text may be passed to the planner. The planner draft uses the server-side session; the language switcher creates neither a language cookie nor a new store of personal information in localStorage.
5. Analytics cookies and Google Analytics
The supported analytics service is a separate consent purpose. Google's measurement code must not load before production activation and consent. Google Analytics documents a default duration of two years for _ga and _ga_<container-id> cookies, which account or tag settings can change. This is a provider reference, not evidence of AppNova's production configuration.
Google's measurement code may load only after production activation and consent for the relevant analytics or Google Ads purpose. Analytics storage and data sending require consent for analytics. Browser cookie lifetimes differ from the Google Analytics account's data retention setting.
6. Google Ads and OpenAI / ChatGPT Ads
Google advertising measurement requires permission for the Google Ads purpose. Supported click identifiers are gclid, gbraid and wbraid. Provider tags may use storage with names beginning _gcl_ or _gac_; the precise inventory and duration depend on the activated product and configuration.
The OpenAI / ChatGPT Ads adapter handles the oppref click identifier only with consent for that purpose. Withdrawal also covers __oppref storage that the website can access. The browser pixel operates only after production activation and separate OpenAI consent; technical support alone does not mean provider cookies are in use.
Server-side conversion sending is distinct from browser cookie handling. Our attribution and delivery windows do not set the providers' own retention periods.
Meta Pixel — measurement amendment, 2026-10-16
After separate Meta consent, Meta Pixel may use the _fbp browser identifier cookie and, following a Meta advertising click, the _fbc click identifier cookie on the AppNova domain. These optional advertising cookies measure page views and successful enquiries. Meta's code can access them; they do not contain form text. Their usual lifetime is up to 90 days, which the browser may shorten or further consented activity may renew. The actual expiry can be checked in your browser.
Without consent, there is no Meta library download, noscript tracking image or Meta data sending. Withdrawal deletes accessible _fbp and _fbc cookies on the application paths and domain; the page may reload to remove the loaded SDK. Cookies on Meta's own domain that this website cannot access must be managed through browser settings. Withdrawal does not automatically erase previously transferred provider data.
Consent evidence separately records the new Meta purpose and amendment version meta-pixel-v1-2026-10-16. Further information: Meta Cookies Policy and the Meta amendment to our Privacy Policy.
7. Our storage and provider storage
The three cookies above and the demo's session storage are separate from storage that external tags may create. External code can write a cookie under the website's own domain; the domain alone does not mean that only the controller has access to measurement data.
Sending data to Google Analytics or Google Ads depends on production activation and consent for the relevant purpose. OpenAI / ChatGPT Ads and Meta Pixel also require separate consent. Provider storage does not mean that data physically remains exclusively within the EEA; section 15 of the Privacy Policy explains international transfers.
8. Consent and partial choices
Optional analytics, Google Ads, OpenAI / ChatGPT Ads and Meta advertising measurement are denied by default. Settings show only the purposes available in the environment. You can select just one purpose; enabling it does not automatically permit the others. Live operation also requires the provider activation conditions to be met.
Use Measurement settings to save or reject choices. Without JavaScript, this remains available as a separate server-rendered form; external browser tags do not run in that case. A failed save does not enable optional measurement.
9. Changing or withdrawing your choice
The Measurement settings link in the footer reopens your choices. “Reject all optional measurement” disables every optional purpose. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
The browser code removes accessible provider cookies and recognised localStorage/sessionStorage keys for withdrawn purposes, rather than clearing all browser storage. Planner answers and demo drafts remain. Other browser tabs recheck the consent state.
The website cannot erase third-party cookies it cannot access or information already received by a provider. Browser settings, the provider's procedure or a request to the controller may be needed. Deleting our preference cookie does not automatically erase all server-side information either.
10. Provider sources and contact
You can read about Google's storage technologies in Google Analytics cookie usage and Google advertising cookies. These are the provider's general descriptions, not a list of cookies set by this website. Our own cookies are listed in section 3 of this policy.
- Data controller: Prognovum System Kft.
- Registered office: 1114 Budapest, Orlay u. 3. mf. 3/A
- Company registration number: 01-09-983736
- Tax number: 23909986-2-43
- Professional contact: Bernáth Mihály Pál
- Email: info@appnova.hu