Cookies and on-device storage

This is a translation. The Czech version is binding. · Čeština

The short version

This website, the app and the booking page for clients set no cookies. Cookies are set only by the sign-in and sync server, and there are three of them — all technical: one carries you through signing in, one recognises your device, one hands the sign-in from the browser over to the installed app. No analytics, no advertising or tracking cookies, no third-party cookies. That is why you will not find a cookie banner here: consent does not apply to storage that is technically necessary.

But cookies are not the whole story, and “we do not use cookies” would be a truth told too briefly. A few small things the website and the app do store on your device even without cookies, and a few things do go out — but only when you tap yourself. Both are described below.

Tricho.app runs on four addresses

• dev.tricho.app — this website (home page, pricing, blog, help, legal pages) and My account. It sets no cookies.
• app.dev.tricho.app — the app itself. It sets no cookies; it stores data in the browser (see below).
• sync.dev.tricho.app — the sign-in and sync server. It sets three cookies, all of them strictly necessary.
• booking.dev.tricho.app — the booking page where a client picks a free slot (the practitioner sends her the link). It sets no cookies and does not use localStorage or sessionStorage either; it keeps the short-lived access token only in the memory of the open page, so it disappears when the page is closed or reloaded.

Three cookies on sync.dev.tricho.app

All of them are HttpOnly, so no script in the browser can read them, and Secure, so they are sent only over an encrypted connection. The admin tool (for the operator only) has no cookie of its own; its token lives only in the memory of the tab. Connecting Google Calendar does not add any cookie either.

All three are technically necessary to provide the service you asked for, and consent does not apply to them under § 89(3) of Czech Act No. 127/2005 Coll., on electronic communications, and under the European rules (ePrivacy). For tricho_device the reasoning is simple: without recognising the device, the device limit of the plan you ordered cannot be enforced, and that limit is part of the service. A year is because the device is meant to stay “the same one” even after months without signing in; the cookies serve nothing other than signing in and recognising the device.

What the website stores on your device

Not cookies — localStorage and sessionStorage. Legally, though, it is the same thing: § 89(3) of Act No. 127/2005 Coll. speaks of “storing data in terminal equipment”, not of cookies. Here is everything this website (the apex) stores:

The first two are your choices, stored so that the website does not ask you a second time. We rely on the view that interface preferences you chose yourself are technically necessary for a function you asked for (see Opinion 04/2012 of the Article 29 Working Party, WP 194, on the cookie consent exemption). None of them contains an identifier, none sends anything to a server, and nobody can be recognised by them. The data in the tab serve only to let the sign-in survive the trip through Google or Apple; none of it has anything to do with the contents of your notebook.

What is loaded from elsewhere

Nothing on this website. We serve all fonts from our own addresses; there is no request to a third party. No embedded maps, videos or scripts. An open page of this website does not touch a single foreign server.

The first exception is the “Let me know” form at the end of the home page — a field where you can leave your e-mail so that we get in touch when something substantial is added. The submission goes straight from your browser to sibforms.com, which is Brevo (formerly Sendinblue), a French service in which we keep that address. No Brevo script runs on the page and nothing is loaded in advance: the request goes out only at the moment you tap the button yourself. Along with the e-mail, your IP address also reaches Brevo, because it cannot work otherwise. The legal basis is your consent (Article 6(1)(a) GDPR) — you give it by submitting, and you withdraw it with the unsubscribe link in every message. More in the privacy policy.

The second is the booking page that a client opens. There, for protection against bots, the Cloudflare Turnstile check is loaded — a script and a small window from the domain challenges.cloudflare.com. It is the only foreign address that page may contact, and the Content-Security-Policy header enforces this. In doing so, Cloudflare sees the IP address and browser details. We add no cookies or storage of our own on the page side.

What the app stores on your device

The app at app.dev.tricho.app is a different origin and a different story. It stores on your device the data it needs in order to work at all — even without the internet. These are not cookies; they are browser storages that are not sent anywhere:

• Your encrypted data (clients, visits, photographs) in IndexedDB storage. It stays on the device and is readable only after unlocking.
• Technical preferences in localStorage: the chosen appearance (light/dark), the code of the chosen plan, the selected camera, and the fact that the camera and microphone work together on your device. The appearance is also stored in the app's database and mirrored into localStorage so that the page does not flash white on load.
• The sign-in token for optional sync, if you have it turned on — encrypted with the same key as your data and stored only on this device; it is not replicated to the server. The short-lived access token lives only in memory and disappears when the app is closed.
• Short-lived helper data: a sign-in with Google or Apple in progress and the count of wrong PIN attempts (sessionStorage, only in that tab), and, for ten minutes, a verification value during sign-in in the browser (localStorage).
• A copy of the app itself (the service worker and its cache), so that it starts even without a signal.

None of this is used for tracking and none of it is sent anywhere by itself. Clearing the site data in the browser (or uninstalling the app) removes it — including your data that has not been backed up, so take care.

Who the app talks to

The app may contact only a few addresses, and this is enforced by the Content-Security-Policy header, which the browser upholds for us:

• our own sync server (sync.dev.tricho.app) — only encrypted data and sign-in;
• Google's servers (www.googleapis.com) — only when you yourself connect Google Calendar; the app then reads and writes events and tasks directly from the device;
• the servers of the Financial Administration (trzbyeet.gov.cz) — only when you yourself turn on sales recording (EET) and submit a sale;
• payment through Stripe is a redirect to their page; the app itself sends nothing to Stripe.

What is not here

So that it is said from the other side too: no analytics (neither Google Analytics, nor Plausible, nor our own), no pixel, no advertising script, no embedded maps, videos or fonts from elsewhere. The foreign addresses this website may touch are only two: Brevo for that form and our own sync server. An analytics script would not load here even if we put it there by mistake.

One thing remains that we cannot merely promise: the website and the app are delivered by Cloudflare Pages, and depending on account settings Cloudflare can add its own operational cookie (typically __cf_bm with bot protection). It is not turned on in our account. Verified on 3 September 2026 at the addresses dev.tricho.app, app.dev.tricho.app and sync.dev.tricho.app — the server's response contained no set-cookie header at all, so not a single cookie from Cloudflare.

How to check

You do not have to trust us. Open the developer tools in your browser (F12), the Application or Storage tab, and look at the cookies and storage for each of the addresses. You will find exactly what is written above.

Questions

Write to [email protected].

Version 2026-10-31. Effective: 31 October 2026.