Cookies and local storage — MyDigiStamp

Last updated: 2026-10-04 Data controller: Izabela Banachiewicz (sole trader, UK), trading as MyDigiStamp Business address: 108 Wood Lane, West Bromwich, B70 9PX, United Kingdom Contact: contact@mydigistamp.com

MyDigiStamp does not use HTTP cookies for tracking or marketing. We use only browser storage that is strictly necessary to deliver the service (login session, language preference, loyalty-card recovery, UI dismiss flags). Under PECR Reg. 6(4)(b) these do not require consent, but we list them in full here for transparency.

No 3rd-party trackers. No analytics cookies. No advertising. Fonts are self-hosted (@fontsource) — zero requests to fonts.googleapis.com or fonts.gstatic.com.

1. Strictly-necessary browser storage

| Key | Where | Purpose | Lifetime | |---|---|---|---| | pieczatka_token | localStorage (will move to httpOnly cookie) | Owner login session (JWT) | Until logout or expiry | | pieczatka_impersonation_original | localStorage (will move to httpOnly cookie) | Super-admin impersonation unwind | Session (cleared on exit impersonation) | | pieczatka_customer_<biz_token> | localStorage | End-customer card recovery on same device | Persistent | | pieczatka_secure_dismissed_<cust_token> | localStorage | Dismiss "Secure your card" prompt | Persistent | | pieczatka_install_dismissed_banner | localStorage | Dismiss PWA install banner | Persistent | | pieczatka_install_dismissed_dashboard | localStorage | Dismiss PWA dashboard prompt | Persistent | | pieczatka_lang_session | sessionStorage | Language preference (pl / en) | Browser session |

2. Why strictly-necessary

All entries above are necessary to provide the service the user requested:

• Login tokens enable authenticated requests.
• Customer-card tokens let a visitor return to their card without re-registering.
• Dismiss flags prevent repeating UI nags.
• Language preference drives the i18n layer.

Removing any of these would break core functionality or significantly degrade UX; they qualify for the "strictly necessary" exemption in PECR Reg. 6(4)(b).

3. 3rd-party resources

• Fonts: self-hosted via @fontsource (Inter, Outfit, Plus Jakarta Sans, JetBrains Mono). Zero external calls.
• Payments: Stripe Checkout and Stripe Portal open on checkout.stripe.com / billing.stripe.com only when the owner clicks a plan or "Manage billing" — never on page load. Stripe is a separate data controller for payment data (see Privacy Policy §5).

4. Changes

We update this page as the storage model evolves (e.g. when login moves to httpOnly cookies). "Last updated" reflects the current state.