About this policy
This policy explains which technologies ReBorSe uses to store or read information on your device, and which external providers receive data when you use the platform.
It is generated directly from our internal technology registry, so it describes what the platform actually does today - not a generic template. Every entry below corresponds to code that runs in production.
Technologies we have built but not switched on are listed separately at the end, and are explicitly not in use.
Browser storage and server-side providers
Not everything in this policy is a cookie. We distinguish two clearly different things:
Technologies that use your device
Cookies, local storage and session storage are written into your browser and can be inspected or cleared by you at any time.
Providers contacted by our server
Some features send data to an external provider from our own server. These providers store nothing in your browser and set no cookies. We list them here for transparency, because your data still reaches them.
Technologies currently in use
Every technology listed here is active in production today.
Strictly necessary
Required to sign in, keep your session secure and technically deliver the service. These cannot be switched off because the service would not work without them.
Supabase authentication
Supabase, Inc.
- Purpose
- Keeps you signed in and protects your session.
- Relationship
- Third-party provider
- When it runs
- On every page, to keep you signed in
- Names used on your device
sb-<project>-auth-tokensb-<project>-auth-token-code-verifier- Storage duration
- Until you sign out
- Data involved
- Account identifier, Session token
- Recipients
- Supabase, Inc.
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Request protection (CSRF)
ReBorSe
- Purpose
- Prevents forged requests being submitted in your name.
- Relationship
- First party (ReBorSe)
- When it runs
- When you submit a form
- Names used on your device
csrf-token- Storage duration
- For the current session
- Data involved
- Security token
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Image format detection
ReBorSe
- Purpose
- Detects which image formats your browser supports so pages load faster.
- Relationship
- First party (ReBorSe)
- When it runs
- When images first load
- Names used on your device
avif-supportwebp-supportoptimal-image-formatbrowser-features- Storage duration
- Until you clear your browser data
- Data involved
- Browser capability flags
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Privacy notice choice
ReBorSe
- Purpose
- Remembers your choice in the privacy notice (accept all, only necessary, or your own selection), with the policy version and the time you chose, so the notice is not shown again until the policy changes. It also holds a random consent ID that is sent to ReBorSe with each choice, so the choice can be proven. ReBorSe keeps that record for 3 years: the consent ID, your choice, whether each optional technology is switched on or off, where you made the choice (this notice or the cookie settings), the version of the privacy notice, the language, the time and, if you are signed in, your account ID. No IP address is stored. When you are signed in, the choice is also saved to your account.
- Relationship
- First party (ReBorSe)
- When it runs
- When you make a choice in the privacy notice or the cookie settings
- Names used on your device
reborse_privacy_notice_ack- Storage duration
- Until you clear your browser data
- Data involved
- Privacy choice with policy version and time
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
- Purpose
- Stores which optional features you have switched on or off, so your choice is respected on every visit. When you are signed in, it is also saved to your account.
- Relationship
- First party (ReBorSe)
- When it runs
- When you make a choice in the privacy notice or the cookie settings
- Names used on your device
reborse_optional_tech_prefs- Storage duration
- Until you clear your browser data
- Data involved
- Privacy settings
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Transactional email (Brevo)
Brevo (Sendinblue SAS)
- Purpose
- Delivers the account and booking emails you need, such as security codes and payment or booking notices. Not used for marketing. Handled entirely on our servers; nothing is stored in your browser.
- Relationship
- Third-party provider
- When it runs
- Only when an account or booking event requires emailing you
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by the provider — see their privacy policy
- Data involved
- Email address, Email notification content
- Recipients
- Brevo (Sendinblue SAS)
- International transfer
- Processed within the EU/EEA
Preferences and functionality
Remember your own settings on your device — language, theme, favourites, recent searches. This information stays in your browser.
Language preference
ReBorSe
- Purpose
- Remembers the language you selected.
- Relationship
- First party (ReBorSe)
- When it runs
- When you choose a language
- Names used on your device
NEXT_LOCALEappLanguage- Storage duration
- Up to 1 year
- Data involved
- Language preference
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Appearance preference
ReBorSe
- Purpose
- Remembers your chosen theme and colours.
- Relationship
- First party (ReBorSe)
- When it runs
- When you change the appearance
- Names used on your device
reborse-color-theme- Storage duration
- Until you clear your browser data
- Data involved
- Display preference
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
- Purpose
- Remembers items you saved as favourites.
- Relationship
- First party (ReBorSe)
- When it runs
- When you save a favourite
- Names used on your device
favoriteItems- Storage duration
- Until you clear your browser data
- Data involved
- Saved item identifiers
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
- Purpose
- Shows your recent searches so you can repeat them. When you are signed in, your searches are also saved to your account.
- Relationship
- First party (ReBorSe)
- When it runs
- When you search
- Names used on your device
searchHistoryreborse-structured-search-history- Storage duration
- Until you clear your browser data
- Data involved
- Search terms
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Saved search filters
ReBorSe
- Purpose
- Remembers the filters you last applied.
- Relationship
- First party (ReBorSe)
- When it runs
- When you change search filters
- Names used on your device
savedFilters- Storage duration
- Until you clear your browser data
- Data involved
- Search filter preference
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
- Purpose
- Remembers whether you prefer list or grid view.
- Relationship
- First party (ReBorSe)
- When it runs
- When you switch between list and grid
- Names used on your device
resultsViewMode- Storage duration
- Until you clear your browser data
- Data involved
- Display preference
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Last used location
ReBorSe
- Purpose
- Remembers your last search location.
- Relationship
- First party (ReBorSe)
- When it runs
- When you use a location
- Names used on your device
lastUsedLocation- Storage duration
- Until you clear your browser data
- Data involved
- Approximate location preference
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Recently viewed items
ReBorSe
- Purpose
- Remembers the items you recently opened so you can find them again. When you are signed in, the list is also saved to your account.
- Relationship
- First party (ReBorSe)
- When it runs
- When you open an item
- Names used on your device
reborse-viewed-items- Storage duration
- Until you clear your browser data
- Data involved
- Viewed item identifiers
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
External processing
Features that send data to an external provider to work. These run only when you use the feature.
Address search (MapTiler)
MapTiler AG
- Purpose
- While you type an address, or when you share your location in a chat, your browser asks MapTiler AG in Switzerland for matching places. MapTiler receives the text you type or the coordinates, and your IP address. It only runs when you use an address field or share a location.
- Relationship
- Third-party provider
- When it runs
- Only while you type an address or share a location
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by MapTiler — see the MapTiler privacy policy
- Data involved
- IP address, Address text you type, Coordinates submitted for lookup
- Recipients
- MapTiler AG
- International transfer
- Transferred outside the EU/EEA to a country with an EU adequacy decision
- Purpose
- Fallback for address search, and checks on our server: when MapTiler cannot answer, the lookup is forwarded by our server, so the provider does not receive your IP address or any cookie.
- Relationship
- Third-party provider
- When it runs
- Only while you type an address or share a location
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by the provider — see their privacy policy
- Data involved
- Address text you type, Coordinates submitted for lookup
- Recipients
- komoot GmbH
- International transfer
- Processed within the EU/EEA
OpenAI text suggestions
OpenAI, L.L.C.
- Purpose
- Generates listing text suggestions when you ask for them. Runs on our servers; nothing is stored in your browser.
- Relationship
- Third-party provider
- When it runs
- Only when you request a suggestion while creating a listing
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by the provider — see their privacy policy
- Data involved
- Listing text submitted for suggestions
- Recipients
- OpenAI, L.L.C.
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Only when you use the feature
These run only after you start the feature yourself — for example when you begin a payment or ask us to verify your phone number. They are not active while you browse.
Item matching progress
ReBorSe
- Purpose
- Remembers the items you skipped in item matching so they are not shown to you again, and whether you reached the end of the deck in this session.
- Relationship
- First party (ReBorSe)
- When it runs
- Only while you use item matching
- Names used on your device
itemMatchingDismisseditemMatchingExhausted- Storage duration
- Until you clear your browser data
- Data involved
- Skipped item identifiers
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
Stripe payments
Stripe, Inc.
- Purpose
- Processes the payment you requested and stores your payment method securely.
- Relationship
- Third-party provider
- When it runs
- Only when you open a payment, reservation or donation page
- Names used on your device
__stripe_mid__stripe_sid- Storage duration
- Set by Stripe — see the Stripe privacy policy
- Data involved
- Payment details, Billing information
- Recipients
- Stripe, Inc., Stripe Payments Europe, Ltd.
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Stripe fraud prevention
Stripe, Inc.
- Purpose
- Stripe sets an additional cookie, only on payment pages, to detect and prevent fraudulent payments. It is strictly necessary for secure payment.
- Relationship
- Third-party provider
- When it runs
- Only when you open a payment, reservation or donation page
- Names used on your device
m- Storage duration
- Set by Stripe — see the Stripe privacy policy
- Data involved
- Device characteristics, Fraud signals
- Recipients
- Stripe, Inc.
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Bot protection (Vercel BotID)
Vercel Inc.
- Purpose
- An invisible check that tells people from automated programs before a booking request, a message, a report, feedback, a waitlist sign-up or a withdrawal declaration is accepted. A short script evaluates technical characteristics of your browser at that moment and Vercel checks the result. It sets no cookie and stores nothing on your device.
- Relationship
- Third-party provider
- When it runs
- Only when you send a booking request, a message, a report, feedback or a waitlist sign-up
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by the provider — see their privacy policy
- Data involved
- Device characteristics, IP address
- Recipients
- Vercel Inc.
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
- Purpose
- Sends the verification code to your phone number. Handled entirely on our servers.
- Relationship
- Third-party provider
- When it runs
- Only when you verify a phone number
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by the provider — see their privacy policy
- Data involved
- Phone number, Verification code
- Recipients
- Supabase, Inc., configured SMS provider
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Push notifications
Google LLC, Apple Inc., Mozilla Corporation, Microsoft Corporation
- Purpose
- When you turn on push notifications for a device, your browser registers a small ReBorSe script (a service worker) and creates a push subscription with its own push service — Google for Chrome and most Chromium browsers, Apple for Safari and for home-screen apps on iPhone and iPad, Mozilla for Firefox, Microsoft for some Edge versions on Windows. ReBorSe stores the subscription address and sends notifications through that push service, encrypted so that only your browser can read them. The script only shows notifications and opens ReBorSe when you tap one; it caches nothing.
- Relationship
- Third-party provider
- When it runs
- Only after you turn on push notifications for a device in the notification settings
- Names used on your device
/sw.js- Storage duration
- Until push is turned off on the device. ReBorSe deletes its copy of the subscription 30 days after it is turned off or stops working, and after 90 days without use. How long the push service keeps data is set by that service.
- Data involved
- Push subscription address, Push notification content
- Recipients
- Google LLC, Apple Inc., Mozilla Corporation, Microsoft Corporation
- International transfer
- May be transferred outside the EU/EEA with contractual safeguards
Legal classification under review
These technologies are active and disclosed here, but their final legal classification is still being reviewed with our data-protection advisers.
- Purpose
- Delivers the map tiles shown on map views. Once you allow maps, your browser loads the map data directly from MapTiler AG in Switzerland, which receives your IP address and the technical data of each request.
- Relationship
- Third-party provider
- When it runs
- Only when you open a map
- Names used on your device
- Does not store anything on your device
- Storage duration
- Set by MapTiler — see the MapTiler privacy policy
- Data involved
- IP address, Requested map area
- Recipients
- MapTiler AG
- International transfer
- Transferred outside the EU/EEA to a country with an EU adequacy decision
The legal classification of this technology is under active review. It is disclosed here because it genuinely runs; the review concerns only how it should be categorised, not whether you should be told about it.
Analytics
Measurement of how the service is used and how fast it loads. Runs only with your consent.
Usage and performance statistics
ReBorSe
- Purpose
- Records which pages and steps of ReBorSe are used and how fast pages load, to improve the app. Each record is anonymous: the page type (never an item, a person or a conversation), the step, loading times, the language and the device class (mobile, tablet or desktop). No user, session or visitor identifier, no IP address stored, no cookies and nothing stored on your device. Runs only if you switch it on.
- Relationship
- First party (ReBorSe)
- When it runs
- On every page, only after you switch on usage statistics
- Names used on your device
- Does not store anything on your device
- Storage duration
- 425 days (about 14 months), then deleted
- Data involved
- Page type and step, Loading times, Language and device class
- Recipients
- Not shared outside ReBorSe
- International transfer
- No transfer - stays on your device or our servers
How we ask for your choice
When you first visit ReBorSe, a notice lets you choose Accept all, Only necessary or Customize. Strictly necessary technologies and the settings you choose yourself, such as your language, theme, favourites and starred conversations, always apply. Optional features, such as maps, recently viewed items, recent searches and usage statistics, stay switched off until you accept them, turn them on in the settings or, for maps, use the Enable maps button. AI text suggestions only run when you ask for one. You can change or withdraw your choice at any time in the cookie and technology settings, also without an account. We store your choice with the policy version and the time you made it, and ask again when this policy changes.
How to control these technologies
You can view the full technology list, grouped by purpose, in your privacy settings.
Open cookie and technology settings
You can also delete or block cookies and clear local storage in your browser settings. Blocking strictly necessary technologies may sign you out, and clearing local storage resets your saved settings and your privacy choice on this device, so the privacy notice asks you again unless you are signed in, in which case your saved choice is restored from your account.
We do not operate any advertising, profiling or cross-site tracking technology. The only statistics we collect are our own anonymous usage and performance statistics, and only if you switch them on; you can switch them off again at any time in the cookie and technology settings.
We do not sell your personal data
ReBorSe does not sell personally identifiable data, and does not share it with advertising networks or data brokers. Whether we might in future publish anonymous, aggregated market insights that cannot be linked to any individual is a separate question that would be decided and communicated on its own terms.
Technologies that are not in use
The following technologies exist in our codebase or account but are switched off. They store nothing, send nothing and collect nothing. We list them so that this policy is complete and auditable.
Changes to this policy
When we add, remove or change a technology, we update the registry this policy is generated from, so the page and the platform cannot drift apart. Material changes are announced before they take effect.
Data controller: ReBorSe
For any question about this policy or your data, contact our privacy team.
Email: privacy@reborse.com
Our full postal details and the information required by § 5 DDG are published in our imprint.
View imprint