Cookie policy
Version 1.1 · In force from 4 October 2026 Published at lyolog.app/cookies — applies to the website only
1. What cookies are
A cookie is a small file a website stores on your device when you visit. Depending on the cookie, it makes the site work, remembers your preferences, or tells the operator how the site is used.
Article 22.2 LSSI-CE permits only strictly necessary cookies without consent. Anything else needs your prior consent.
2. Cookies that are always on
These are technical cookies, or personalisation you chose yourself. They need no consent.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
sb-vushmaemhglikikmrvzk-auth-token (may be split into .0, .1…) |
LyoLog (first party), only once you sign in on the website | Keep you signed in to the account area | 400 days, or until you sign out |
sb-vushmaemhglikikmrvzk-auth-token-code-verifier |
LyoLog (first party), only while you complete a sign-in code or a password reset | Link the code or link we email you to your browser; deleted once you sign in | Until you complete the sign-in; at most 400 days if you abandon it |
lyo_lang |
LyoLog (first party), only if you use the language selector | Remember the language you chose | 12 months |
zaraz-consent |
Cloudflare Zaraz (first party), only if you accept analytics | Record that you accepted, so the analytics tools may run; deleted if you withdraw | 12 months, or until you withdraw consent |
lyo-consent-v1 (kept in your browser’s local storage, not a cookie) |
LyoLog (first party), once you choose in the cookie banner | Remember your choice so the banner does not ask again | 9 months, after which we ask again |
cf_clearance |
Cloudflare, only if its security check challenges your visit | Record that you passed the security check | 30 minutes |
cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m |
Cloudflare, only during a security check | Cloudflare’s internal diagnostics for the check itself | For the duration of the check |
lyo_feedback_draft (kept in your browser’s session storage, not a cookie) |
LyoLog (first party), only while you write in the feedback form | Keep what you have typed if the page reloads before you send it. It is not sent to us until you press Send | Deleted when you send the message or close the tab |
Under the AEPD cookie guide, personalisation decided by the user — such as language or currency — is technical and needs no consent, provided it is not used for anything else. We do not use it for anything else.
The feedback form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile runs only on that page and, as configured, sets no cookie on lyolog.app. What it reads, and Cloudflare’s own use of it, are explained in sections 3 and 4 of the privacy policy.
3. Analytics cookies — only if you accept
If you accept analytics in the banner, we use two tools to understand how visitors use the website so that we can improve it. We do not use them for advertising or to build a profile of you. If you reject, or make no choice, none of these cookies is set and neither tool runs.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
cf_zaraz_client, cfz_google-analytics_v4 |
Google Analytics, through Cloudflare Zaraz (first party) | Tell visits from the same browser apart, so pages viewed are counted per visitor | 12 months |
cfzs_google-analytics_v4 |
Google Analytics, through Cloudflare Zaraz (first party) | Group the pages of one visit | Until you close the browser |
_clck |
Microsoft Clarity (first party) | Keep a pseudonymous Clarity identifier, so visits from the same browser are grouped | 12 months |
_clsk |
Microsoft Clarity (first party) | Link the pages of one visit into a single session recording | 1 day |
Google Analytics runs on Cloudflare’s servers rather than in your browser: your browser talks only to lyolog.app, and your IP address is not passed to Google.
Microsoft Clarity records how you move through a page — clicks, scrolling, pointer movement — as a replay, and builds heatmaps from many visits. Text typed into forms is masked and never recorded. Clarity is not loaded on the sign-in pages or in the account area. We tell Clarity that you have not consented to advertising use, so it does not share data with Microsoft Advertising and sets no cookies on Microsoft’s own domains.
One thing to know before you decide: Microsoft is not acting on our instructions here. Under its own terms for Clarity, Microsoft and we are independent controllers, and Microsoft uses what Clarity collects for its own purposes as well as showing it to us, under the Microsoft Privacy Statement. That is why it runs only if you accept, and stops as soon as you withdraw. See section 4 of the privacy policy.
4. Counting visits without cookies
Separately, Cloudflare Web Analytics counts page views, referring sites, countries and browser types across the website. It sets no cookies, stores and reads nothing on your device and does not identify you, so it runs whatever you choose in the banner.
5. Accepting, rejecting and changing your mind
- On your first visit a banner asks you. Accept and Reject are the same size and colour. Until you choose, no analytics tool runs.
- You can change your choice at any time under Cookie settings, at the bottom of every page. If you withdraw consent, we delete the analytics cookies from your browser and neither tool runs again. Withdrawing does not affect what was processed before.
- We ask again after 9 months, or sooner if we change the tools we use.
- Rejecting does not limit your use of the website in any way.
6. Controlling cookies in your browser
You can block or delete cookies in your browser settings. Blocking technical cookies may stop the account area working.
7. The mobile app
The LyoLog app uses no cookies. It does store information on your device so it can work offline and keep you signed in: Article 5(3) of Directive 2002/58/EC applies to native apps as well as browsers, and that storage falls within the strictly-necessary exemption, because it is the service you asked for.
The app also contains no usage-analytics tooling, so there is nothing inside it to accept or reject. The website analytics described above do not run in the app. All on-device storage is explained in the Privacy Policy.
8. Changes
Each amendment produces a complete new version, identified by its number and date of entry into force.
Operator: Jan Panek, NIF Y2362080V, Rotonda de Versalles 23, 28512 Villar del Olmo, Madrid, Spain · support@lyolog.app
Version 1.1 — in force from 4 October 2026