Cookie Policy
Last updated: 14 October 2026 · Effective: 14 October 2026 · Previous version: 4 October 2026, 19:40
Thalamus sets two kinds of cookies. Strictly necessary ones: sign-in and language selection do not work without them. And appearance cookies, which appear only after you pick a theme, a colour or a feed tab yourself. There are no analytics or advertising cookies, hence no consent banner.
WHY THERE IS NO BANNER
Under Article 22.2 of the Spanish LSSI-CE law and the AEPD cookie guide, no consent is required for strictly necessary cookies or for appearance settings a person chose themselves. If analytics with identifiers appears, a banner with equally weighted “Accept” and “Reject” buttons will come first, and only then the script.
1. WHAT COOKIES ARE
1.1 Definition
A cookie is a small file that a site stores in your browser so it can recognise it on the next request. Browser local storage and session storage do similar jobs.
1.2 Our approach
We set only what the service needs to work. There are no third-party trackers, advertising pixels or external analytics systems in the service.
2. COOKIES WE SET
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| sb-… (several files) | Keeps your session after sign-in | First-party, strictly necessary | Until you sign out |
| NEXT_LOCALE | Remembers the chosen interface language | First-party, strictly necessary | Up to one year |
| thal_theme | Remembers the theme you chose: light or dark | First-party, appearance you chose | Up to one year |
| thal_accent | Remembers the accent colour you chose | First-party, appearance you chose | Up to one year |
| thal_feed | Remembers the feed tab you picked last: communities or meetups | First-party, appearance you chose | Up to one year |
| tg_login_ctx | Remembers which page and language to return you to after signing in with Telegram, and carries a one-time sign-in security code. Set at the moment you press the button. Not readable by page scripts | First-party, strictly necessary | 10 minutes |
2.1 What happens if you delete them
Your session ends: you will need to sign in again and pick your language, theme, colour and feed tab again. Nothing else breaks.
3. BROWSER LOCAL STORAGE
| Key | Purpose | Where it lives | Lifetime |
|---|---|---|---|
| thalamus-maps-ok | Remembers that you allowed the map to load on provider pages | Your browser, Thalamus domain | Until you clear browser data |
| learn-progress:… | Learn: the checklist items and sessions you ticked off; your notes “in your own words”, if you made them before 24 September 2026 | Your browser, Thalamus domain | Until you clear browser data |
| learn-share:… | Learn: carries your notes into the club’s new-post field so you do not retype them | Your browser, this tab’s session storage | Until you touch the field, publish, or close the tab |
| vnj-checklist:… | Residence-permit document checklist: which documents you have ticked off | Your browser, Thalamus domain | Until you clear browser data |
| th_identity_v1, th_identity_export_v1 | Identity map: your answers and the date you last exported it to a file | Your browser, Thalamus domain | Until you delete the map or clear browser data |
| thalamus.return.days, thalamus.return.sent | Return mark: the dates of your visits, up to the last sixty (see 5.2) | Your browser, Thalamus domain | Until you clear browser data |
| Studio materials: scripts, versions, settings, language-model key | Keeps your Studio work on your device | Your browser, studio.thalamus.community | Until you clear browser data |
3.1 This data stays on your device
Browser storage contents stay on your device. We do not receive them and keep no copies, so clearing browser data deletes them permanently: ticks, notes, your identity map, Studio materials. They do not exist on another device or in a private window.
3.2 What reaches the server
Only what you send yourself. A note “in your own words” becomes a club post when you press publish in the feed. From the return mark we receive only the fact of a return, as described in 5.2.
4. THIRD-PARTY SERVICES
4.1 Maps
The map on a provider page loads only after you press the button. Before that press not a single request goes to the map service. After it, Google receives your IP address and may set its own cookies under its own rules.
4.2 Payments
We take no payments at the moment: there are no checkout pages and no payment-provider cookies on the service. When payments are switched on, those cookies will be described here before the first payment.
4.3 The Studio tool
The Studio tool opens in an embedded frame from studio.thalamus.community. It sets no cookies: authentication works through a temporary token and data lives in local storage.
4.4 Anti-bot check
The sign-in and sign-up forms carry a Cloudflare “not a robot” check. It is technically necessary and loads together with the form, so Cloudflare receives your IP address and browser data before you press anything, and may use its own cookies under its own rules. The check protects the forms from automated requests: without it a robot could send confirmation codes in bulk to other people’s email addresses. The mark it issues lives for five minutes and is accepted once.
4.5 The Telegram sign-in button
The Telegram sign-in button is ours. Not a single request goes from this page to Telegram, and Telegram does not know you opened our sign-in form. Pressing it takes you to Telegram’s own site: you confirm the sign-in there, and there Telegram sees you under its own rules. Until 20 September 2026 this place held Telegram’s own button embedded in our page. Telegram moved sign-in to a new protocol and we moved with it — no third-party code runs on this page at all now.
5. COOKIE-FREE VISIT AND ACTION COUNTER
5.1 What is collected
We count anonymous page views: the browser sends the address of the page you opened, the host you came from, for example t.me, and a campaign tag if you followed one of our tagged links. The tag is a channel name such as “telegram”; anything else is stripped from it on arrival. No cookies, no IP address, no identifier.
In the same way we record actions on the pages: filters chosen in the catalog and the number of listings found, sign-up steps and the reason a sign-up did not go through, a press on a contact in a provider’s listing. The record holds codes and numbers; no email, no text, nothing you typed into form fields. Along with the record the browser reports one flag: whether a program is controlling it. The browser sets this flag itself, and we need it to keep our own automated site checks out of the statistics.
5.2 Return marker
To see whether people come back, the browser keeps a list of the dates you visited — up to the last sixty. That list stays on your device and never reaches us. All we receive is the fact itself: “came back on a second separate day” and “came back in a second separate week”, together with their count.
5.3 Why it needs no consent
The records cannot single out a person, so they are not personal data. Everything described in this section is first-party audience measurement: at the page’s request the browser reports a page view, an action and the flag from section 5.1, and it keeps the list of dates from section 5.2 on the device. The AEPD guidance on audience measurement tools exempts such counters from consent provided the data serve only the site’s own anonymous statistics, are not matched with other data, are not passed to third parties, and are described here. These data are shared with no one.
5.4 Retention
Rows older than 12 months are deleted automatically on schedule. The list of dates in the browser keeps up to the last sixty visits and is removed together with the site data.
6. HOW TO MANAGE THIS
6.1 In your browser
Cookies and local storage are cleared in browser settings, under privacy and site data. The same place lets you block cookies for a single site — sign-in will then stop working.
6.2 Maps
To take back the permission to load maps, clear the site data in your browser: the confirmation button will appear again. Clearing site data also erases everything else listed in section 3.
6.3 Questions
Questions about cookies and storage: hello@thalamus.community. How personal data is processed is described in the Privacy Policy.
Last updated: 14 October 2026 · Effective: 14 October 2026