enter.place legal
Cookie Policy
This Policy describes the cookies and similar browser-storage technologies used by enter.place.
- Effective date
- 31 August 2026
- Version
- 2.1
1. About this Policy
This Cookie Policy applies to enter.place, operated by DOMUS SAPIENS LTD, company number 15319608, registered at 128 City Road, London, EC1V 2NX, United Kingdom. Contact: info@enter.place.
A cookie is a small text value stored by a browser. Similar technologies, including localStorage, can remember settings on a device. This Policy covers both.
2. Current approach
The current production Service uses first-party storage for authentication, secure navigation, language and interface choices. Product analytics, first-party aggregated traffic measurement and application error monitoring operate without placing analytics cookies or persistent analytics identifiers in localStorage. We do not use advertising cookies, cross-site tracking or session replay.
A public document request is added directly to separate daily counters for its canonical entry page, external referring hostname, interface language, country and broad device category. The counters contain no visitor identifier or exact visit time and cannot be combined into an individual journey. Detailed canonical account navigation is associated only with a signed-in account. Guest-link activity is a separate owner-facing feature described below.
Guest-link activity uses a random visit identifier held on the device only in the open page’s memory. The identifier can be included in server-side activity records, but it is not written to cookies or localStorage and does not recognise the same anonymous visitor after the page is closed or reloaded.
Signup attribution also does not use a cookie or browser-storage identifier. During a requested Google or email sign-in, the link carries a random one-time code that refers to a server-side record containing only a coarse channel, bounded campaign code and canonical landing route. The code expires after approximately 20 minutes and is consumed after authentication. It cannot be used to follow an anonymous visitor across days or devices, and raw referrer URLs, IP addresses and user agents are not stored in that attribution record.
3. Cookies
| Name | Purpose | Typical duration | Category |
|---|---|---|---|
enter_locale | Remembers the language selected for the main interface. | Up to 1 year | Interface preference |
enter_guest_page_locale | Remembers the language selected for one specific guest guide. | Up to 1 year | Interface preference |
enter_auth_next | Temporarily remembers the safe page to open after authentication. | Up to 10 minutes | Strictly necessary |
sb-<project-reference>-auth-token and split variants | Supabase authentication cookies used to establish, refresh and protect the signed-in session. The exact project-specific suffix can vary. | Session and refresh duration configured by Supabase Auth | Strictly necessary after sign-in |
Development and automated-test environments can use separate test-only cookies. They are disabled in the production Service and are not listed as production cookies.
4. localStorage and similar storage
| Key or pattern | Purpose | Duration |
|---|---|---|
enter.place.guestLocale | Guest-guide language preference used by the interactive guide. | Until cleared or replaced |
enter.place.guest-theme | Remembers the guest’s light or dark theme choice. | Until cleared or replaced |
enter.place.guide-welcome:<guide> | Remembers that the welcome/help panel for a particular guide was dismissed. | Until cleared |
enter.place.external-map-hint:<hint> | Remembers that an external-map hint was dismissed. | Until cleared |
enter.place.owner-overview-view | Remembers the owner’s selected view in the place overview. | Until cleared or replaced |
5. Third-party services
Supabase processes authentication cookies on our behalf. Vercel delivers the site and processes its necessary infrastructure requests and operational logs. PostHog receives allowlisted pseudonymous product events from our server, and Sentry receives limited application error and performance information. These integrations do not place product-analytics cookies or persistent analytics values in localStorage, and Session Replay is disabled.
City maps can request tiles from OpenStreetMap tile services. Map, street-view, geocoding, routing and translation features can communicate with Google through our servers or service endpoints. These current integrations do not require us to place Google advertising cookies on enter.place.
If you choose an external navigator such as Google Maps, Apple Maps, Yandex Maps or 2GIS, you leave or open another service. That provider may use its own cookies under its own policy.
6. Is a consent banner required?
The current configuration does not set product-analytics, advertising or cross-site tracking cookies or persistent analytics identifiers. Authentication storage is used after a user requests sign-in, and language/theme/help storage records interface choices requested by the user. However, using a server-side or memory-only analytics design does not by itself remove every data-protection or storage-and-access obligation.
The one-time signup-attribution code is transported only as a short-lived URL parameter inside the requested authentication journey. It is not written to a cookie, localStorage or sessionStorage. The existing enter_auth_nextcookie remains limited to the safe post-authentication destination and does not contain marketing attribution.
The consent or objection mechanism must be reviewed before enabling anonymous individual journey histories, session replay, advertising, persistent anonymous visitor recognition, analytics device storage or any other non-essential device access. These functions are not enabled by the current product-analytics configuration. Where consent is required, the relevant technology must remain disabled until the user makes a clear choice, and withdrawal must be as easy as acceptance.
Cookie rules differ by country and continue to develop. A regulator or court may classify a particular use differently, especially for long-lived authentication or preference storage. We will update this Policy and the consent mechanism if the applicable rules or actual technology change.
7. Your controls
You can delete or block cookies and site data using browser settings. Blocking authentication cookies prevents sign-in. Clearing language, theme or help preferences resets them to product defaults. Private-browsing modes usually remove local site data when the private session ends, subject to browser behaviour.
8. Changes to this Policy
We will update the effective date, version and tables when storage technologies or their purposes change. Analytics, error monitoring that uses device storage, payments, new map or email providers, advertising, new markets or revised retention practices require a Cookie Policy and consent review before those technologies or purposes are enabled. Material changes will be communicated through the Service or account contact details where appropriate.