Cookies and browser storage

Browser storage used by bukk.io

Browser storage includes cookies, local storage and session storage. The application currently has no advertising pixels or optional analytics SDK. We do not ask for marketing consent as a condition of signing in.

Local storage named orbit_access_token keeps the sign-in token. The token expires on the server (currently up to seven days); the browser value itself remains until sign-out, rejected-session cleanup or deletion of site data. orbit_workspace_id remembers the selected building. These values support the account service you request and are not advertising identifiers.

Session storage named orbit_receipt_<booking id> keeps a private booking-receipt access token for the current browser tab/session. Treat receipt links as private. Storage for a session can be restored by some browsers when tabs are restored.

Security, maps, images and payments

Cloudflare Turnstile loads on registration and guest checkout to detect automated abuse. It processes technical browser and network signals on our behalf to secure the website. Cloudflare also acts as an independent controller when using signals to improve Turnstile’s bot detection. It is used for security, not for advertising. Cloudflare explains these activities in the Turnstile privacy notice.

Explore loads map resources from OpenFreeMap. Published images can load from Vercel Blob. Your browser sends technical request data, including an IP address, to the relevant provider when it loads that content.

Paddle.js loads when an administrator chooses to open subscription checkout. The payment frame and any storage it requires are supplied by Paddle. Paddle is not loaded on the landing page, login page or general browsing. Its own notices explain payment, fraud-prevention and browser-data processing.

• Cloudflare Turnstile privacy notice
• OpenFreeMap privacy notice
• Paddle privacy notice
• Other service providers

Control and future changes

You can sign out and clear bukk.io site data in your browser. This may remove your session, selected building and receipt access, but it does not itself delete server records or cancel bookings or subscriptions.

If we introduce optional analytics or advertising storage, we will explain its purpose and providers and obtain consent where required before it is used. Refusing or withdrawing optional consent will not prevent access to the core account service.

• Privacy notice