2. Storage items per surface
2.1 Public booking page (booking.bokko.app)
The booking page uses no analytics or advertising cookies and shows no consent banner.
| Name / type | Source | Purpose | Retention |
|---|---|---|---|
bokko.booking.guest.<business> (localStorage) |
Bokko | Offering, at the next booking, the name, optional email address and — if you provided one — the first name given for the newsletter that you previously entered at that business. The details are only offered, never filled in automatically; no phone number is stored. A convenience feature. | 30 days |
bokko_theme (localStorage) |
Bokko | Remembering the selected light or dark appearance. | Until deleted |
| Payment return counter (sessionStorage) | Bokko | Limiting repeated reloads of the return page after an online payment. | Until the browser tab is closed |
bk-gc-attempt:<business>, bk-pass-attempt:<business> (sessionStorage) |
Bokko | For a gift card or pass purchase, a random identifier of the purchase attempt, so that a retry or a page reload belongs to the same purchase and no duplicate purchase is created. Created only when purchasing is available on the booking page. Storage item required for the requested function. | Until the browser tab is closed |
_GRECAPTCHA |
Google (reCAPTCHA Enterprise) | Bot and abuse filtering. The protection starts when the page loads (on both the booking and the guest lifecycle pages), not only when a booking request is sent. A necessary security item; details in Section 4a of the Privacy Policy. | As determined by Google |
firebase-app-check-database, firebase-heartbeat-database (IndexedDB) |
Google Firebase (App Check) | Verifying that requests come from the Bokko booking page (abuse protection). Created when the page loads. | As determined by Firebase |
__session (cookie, only on the "My Data" page: booking.bokko.app/hu/adataim) |
Bokko | Identifying the guest data-management portal session after opening the sign-in link received by email. HttpOnly, Secure. | 30 minutes |
The Google Maps map of the location loads only on click, and Bokko does not store the decision.
2.2 Business dashboard (bokko.app) and admin interface (admin.bokko.app)
The dashboard and the admin interface use no analytics or advertising cookies and therefore show no consent banner.
| Name / type | Source | Purpose | Retention |
|---|---|---|---|
firebaseLocalStorageDb (IndexedDB) |
Google Firebase Authentication | Keeping you signed in (ID and refresh token). | Until sign-out; the ID token renews hourly |
firebase-app-check-database, firebase-heartbeat-database (IndexedDB) |
Google Firebase (App Check) | Verifying that requests come from the Bokko application (abuse protection). | As determined by Firebase |
_GRECAPTCHA |
Google (reCAPTCHA Enterprise) | Bot and abuse filtering in the sign-in and registration flow. | As determined by Google |
firebase-messaging-database (IndexedDB) and browser notification permission |
Google Firebase Cloud Messaging | Only if you enabled push notifications: storing the push token for delivery. Push notifications do not contain a guest's name or contact details. | Until the permission is revoked or sign-out |
bokko_theme_mode, bokko_dashboard_locale (localStorage) |
Bokko | Remembering appearance mode and language. | Until deleted |
Interface preferences (localStorage, with the flutter. prefix) |
Bokko | For example the notification sound, hiding the install prompt, dismissed notices, staff selected in the calendar view, and the location filter of reports. | Until deleted |
referral_ref_v1 (localStorage) |
Bokko | If you arrive via another business's referral link, keeping the referral code until registration is completed. | 30 days |
bokko_admin_totp_session, bokko_admin_totp_write_session (sessionStorage, admin interface only) |
Bokko | Temporarily remembering successful two-factor authentication. Contains a user identifier and a timestamp. | At most 8 hours, or until the browser tab is closed |
demoSessionStartedAt (sessionStorage, demo account only) |
Bokko | Measuring the time limit of the "Try it" demo session. | Until the browser tab is closed (a demo session lasts at most 30 minutes) |
setup_draft_v1:<project>:<user> (localStorage, dashboard only) |
Bokko | The unfinished draft of the post-registration setup: the business name you entered, the booking page address (slug) and the selected activities, so that they are not lost when the page reloads. | Until setup is completed or abandoned (the dashboard then deletes it) |
bokko_dashboard_fs_recovery_v1, bokko_admin_fs_recovery_v1 (sessionStorage) |
Bokko | Keeping track of automatic reload attempts after a database connection error, so that the page does not enter an endless reload loop. Contains no personal data. | Until the browser tab is closed |
previewInitiated_<slug> (sessionStorage, dashboard only) |
Bokko | Remembering that you opened the booking page preview before publishing. | Until the browser tab is closed |
bokko_force_load (sessionStorage) |
Bokko | If, after an unsupported-browser notice, you still load the application with the "Retry" button, remembering this so that the notice is not shown again. | Until the browser tab is closed |
The dashboard automatically deletes, on its next opening, the analytics cookies previously set on the
bokko.app domain (_ga, _ga_<id>, _gid) as well as the
bokko_consent cookie and the bokko_consent_v1 item that stored the consent state.
2.3 Information sites (getbokko.com, help.bokko.io, docs.bokko.io, status.bokko.io)
| Name / type | Surface | Purpose | Retention |
|---|---|---|---|
bokko_consent (cookie) and bokko_consent_v1 (localStorage) |
getbokko.com | Storing your consent decision on measurement. A necessary storage item. | 1 year (cookie); until the decision is changed (localStorage) |
| Cloudflare Web Analytics script | getbokko.com | Aggregated visit statistics. Loaded only with consent; it sets no cookie and builds no individual user profile. | Stores no data in the browser |
bokko_lang, bokko_theme (localStorage) |
getbokko.com, help.bokko.io, docs.bokko.io, status.bokko.io | Remembering the selected language and appearance. | Until deleted |
hc_feedback_<article> (localStorage) |
help.bokko.io | Remembering that you already indicated whether a help article was useful; the feedback is not transmitted. | Until deleted |
There is no analytics measurement on help.bokko.io, docs.bokko.io and status.bokko.io.
2.4 Internal documentation (internal.bokko.io)
The internal documentation site, available only to authorised Bokko users, uses a __session
session cookie (HttpOnly, Secure, SameSite=Strict) after sign-in, valid for 8 hours.
2.5 Marketing / remarketing
Bokko uses no remarketing or targeted advertising cookies on any of its surfaces.
3. Consent and measurement
A consent banner appears only on getbokko.com, because only there does consent-based measurement (Cloudflare Web Analytics) run. The measurement script does not load before consent is given.
The business dashboard, the admin interface, the booking page, the help centre, the developer documentation and the status page have no consent-based storage items, so no banner appears there. Bokko records the main steps of business registration, setup and publishing the booking page in its own database; it uses neither browser storage nor a third-party analytics service for this (see Section 3 of the Privacy Policy).
On docs.bokko.io/api, the API documentation renderer library loads from the jsDelivr content delivery network (operator: Volentio JSD Limited, United Kingdom); it sets no cookie, but the server may log IP addresses under its own rules.
4. Third-party content
For online payments (deposit, card guarantee, on-site online payment, subscription fee), payment takes place on the payment provider's (Stripe or Barion) own payment page. On those pages the payment provider may set its own cookies or similar technologies, governed by its own privacy and cookie policy.
The Google Maps map on the booking page loads only when you click "Show map"; Google may then use its own cookies and storage items.
Bokko's pages contain no embedded social media plugins. The full list of providers used by Bokko — with the place of processing and the transfer safeguard — is set out in the list of sub-processors.
5. Managing settings
Consent on getbokko.com: you give your decision in the banner shown on your first visit and can change it at any time with the "Cookie settings" link at the bottom of the page. When you withdraw consent, the page removes the already loaded measurement script and reloads, so measurement stops immediately and does not load later; since the measurement sets no cookie and builds no individual profile, no measurement data remains in the browser to delete.
Browser-level management: you can delete storage items in your browser settings. After deleting items needed for sign-in, security or the portal session, you will need to sign in again or request a new sign-in link.
- Chrome: Settings → Privacy and security → Third-party cookies / Site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
6. Changes
If there is a material change in the use of storage items — in particular the introduction of analytics or marketing items — we update this policy in advance and apply a consent mechanism on the surface concerned.
7. Contact
Questions about cookies can be sent to support@bokko.app.
8. Do Not Track (DNT)
Bokko respects the browser's Do Not Track (DNT) signal: if DNT is enabled in your browser, consent-based measurement does not load on getbokko.com — even if you previously gave consent in the banner. Necessary storage items are not affected.