This policy lists everything that makelocal.eu stores on your device or reads from it. "Device" means your browser: cookies, local storage, session storage and the browser database (IndexedDB). The site is run by CODE THE CODE sp. z o.o. (the "controller", "we"). Our privacy policy explains what we do with personal data more broadly.
Which items need your consent
The Polish Electronic Communications Act (art. 399, which implements Article 5(3) of the EU ePrivacy Directive) lets a website store or read information on your device without asking only when this is strictly necessary to provide a service you asked for. Everything else needs your consent first.
So MakeLocal works like this:
- Strictly necessary items are always on. They keep you signed in, remember your language and your consent choice, and keep the pages you use working. They are all listed below.
- Analytics items are stored only after you choose "Allow analytics" in the consent banner. Before that, and after a "Don't allow", our analytics script is not loaded at all, so it reads nothing from your device and stores nothing on it.
- We use no advertising cookies and no social-media cookies, and we sell no data.
Changing your choice
You can change your analytics choice at any time with the Cookie settings link at the bottom of our public pages, such as the home page. If you withdraw your consent, we stop analytics in your browser and delete the analytics items listed below from it. Withdrawing does not affect what was collected while you had agreed. If you are signed in, your choice is also kept on your account, so it follows you to other devices.
You can also delete or block cookies and other site data in your browser's settings. If you block the strictly necessary items, signing in and parts of the site will stop working.
Strictly necessary items
Signing in (cookies set by our server)
These cookies are set by our server on makelocal.eu and its subdomains. They are HttpOnly, so scripts on the page cannot read them, and they are sent only over encrypted connections.
ml-refresh-token: keeps you signed in. It holds the token our server uses to get you a new short-lived sign-in token when the current one runs out. Lifetime: 30 days, renewed each time it is used. Deleted when you sign out. Provider: MakeLocal.ml-id-token: holds proof of your sign-in, which our sign-in service needs to end your session when you sign out. Lifetime: 30 days. Deleted when you sign out. Provider: MakeLocal.ml-auth-state: protects the sign-in step against forged requests and remembers which page to return you to afterwards. Lifetime: 10 minutes; deleted as soon as sign-in finishes. Provider: MakeLocal.ml-access-token: older versions of MakeLocal stored this cookie. We no longer set it and delete it if we find it.
Sign-in itself happens on our sign-in service at auth.webtree.org. That service sets its own session cookies on its own domain, auth.webtree.org, not on makelocal.eu. They are needed to sign you in and to keep you signed in across visits.
Your language
INTLAYER_LOCALE(cookie): remembers the language you picked in the language menu. Lifetime: until you close the browser. Provider: MakeLocal.
Your consent choice
make-local-analytics-consent(local storage): records whether you allowed analytics, when you answered, and which version of the banner you answered, so that we do not ask again on every page. If you are signed in, it also records which account gave the answer. Lifetime: until you clear your browser's site data. When our banner or this policy changes in a way that affects your choice, we ask again. Provider: MakeLocal.
Keeping the app working (browser storage)
These items are set by our own scripts on makelocal.eu. Items in local storage and the browser database stay until you clear your browser's site data, unless stated otherwise. Items in session storage are deleted when you close the tab.
Local storage:
ml.session: your short-lived sign-in token together with a copy of your profile (your account number, email address, roles and capabilities; no password), so the app can open quickly and work offline. The token expires within an hour and is renewed in the background. Deleted when you sign out.ml.auth.signedInBefore: notes that this browser has signed in before, so the site can sign you in again silently. Deleted when you sign out.ml.activeOrgId: the workspace you last selected. Deleted when you sign out.makelocal-active-view:followed by your account number: the part of the app you used last (for example the Maker or the Seeker view).makelocal.pendingOrderRequest: an order you started before signing in, so it is not lost while you sign in. Deleted once the order is resumed.makelocal:stock-add:module:andmakelocal:stock-add:supply:, each followed by a workspace number: drafts of stock you are adding as a Maker, so they survive a reload.makelocal:asset-versions-seen:followed by a machine number: which version of a machine's details you have already seen, so we can mark new versions.production-location:add-city-dismissed:followed by a location number: a reminder about a production location that you dismissed.makelocal-active-role,ml.accessTokenandml.currentUser: older versions of MakeLocal stored these (your last-used view, a sign-in token, and a copy of your profile). If we find them, we move the view tomakelocal-active-view:, the profile toml.session, and delete all three.profileId: a random number that identifies this browser to the sync engine described under "Browser database". It is not linked to you outside that engine.
Session storage:
ml.auth.silentAttempted: makes sure the site tries to sign you in silently only once per tab.stripe-connect:return-to: the page to bring you back to after you finish setting up payouts with Stripe.tsr-scroll-restoration-v1_3: your scroll position on each page, so the back button returns you to the same place._zeroReloadReasonand_zeroReloadBackoffState: used by the sync engine to recover from a connection error without reloading in a loop.
Browser database (IndexedDB):
- Databases named
rep:zero-…andreplicache-dbs-v0: a local copy of the data you are allowed to see (your orders, chats and workspace, or the public catalogue if you are not signed in). This is what lets MakeLocal open instantly and keep working on a weak connection. The copy is not deleted when you sign out; databases that have not been used for two days are removed the next time MakeLocal runs in that browser. Clearing your browser's site data removes them at once. - Database
makelocal, storepending-uploads: 3D model files you picked before signing in, kept until they are uploaded after you sign in.
Payments (Stripe)
On pages that offer a payment form (catalogue pages for models and products, and the payment step of an order), our payment provider Stripe loads its script. Stripe sets these cookies on makelocal.eu to detect and prevent payment fraud:
__stripe_mid: identifies the browser for fraud prevention. Lifetime: 1 year. Provider: Stripe.__stripe_sid: identifies the browsing session for fraud prevention. Lifetime: 30 minutes. Provider: Stripe.
Stripe's own privacy policy, at stripe.com/privacy, describes how Stripe uses this information.
Items that are not strictly necessary
Event map
makelocal:ws:src(session storage): on our event map at makelocal.eu/ws, it records which of our printed QR codes (for example the poster or a flyer) brought you there. It is sent with a pin you post, so that we can tell which poster worked. Lifetime: until you close the tab. Provider: MakeLocal. This is the one item we currently store without asking although it is not strictly necessary; we are changing the event map so that this information travels in the page address instead and nothing is stored.
Analytics, only after you allow it (PostHog)
If you choose "Allow analytics", our analytics provider PostHog stores the following on makelocal.eu. Nothing here is stored before you agree.
ph_followed by our PostHog project key and_posthog(a cookie and a local storage entry with the same name): a random identifier that lets us recognise your later visits, and the state of your current visit. If you are signed in, it is linked to your internal account number. Lifetime: 1 year. Provider: PostHog, through our own domain.- Other local storage and session storage entries starting with
ph_or__ph_: the state of the current visit and of a session recording. Lifetime: until the visit ends, or until you clear your browser's site data. Provider: PostHog.
If you withdraw your consent, we delete all of these from your browser.
Information we read from your device without storing anything
Reading information from your device is covered by the same rule as storing it. Apart from what our pages and the items above need to work, only two things read from your device without asking:
- Error reports. When part of MakeLocal fails in your browser, the page reads the technical details of the fault and the name and version of your browser and operating system, and sends them to us. This is necessary to provide the service you are using (art. 399(3)(2) of the Polish Electronic Communications Act). Nothing is stored on your device to do this. The privacy policy explains exactly what a report contains.
- Fonts. Our pages load their fonts from Google Fonts. To deliver them, your browser sends Google its IP address and a standard request. Google Fonts stores no cookies. See the privacy policy, section 3.14.
Our server also counts page loads, but it uses only the address of the page you asked for, which your browser sends to any website. It reads nothing else from your device. The privacy policy describes these counts.
Changes to this policy
When we add, remove or change an item, we update this page and the date at the top. If the change affects what you agreed to, the consent banner asks you again.
Contact
Questions about this policy: privacy@makelocal.eu.