Skip to main content
own2pwn

Cookie and tracker policy

Last updated:

1. Cookies, and trackers more broadly

A cookie is a small text file placed on your device (computer, tablet, smartphone) by a website. It allows the site to remember information about your visit, such as your preferences or your authentication state.

Article 82 of the French Data Protection Act does not cover cookies alone: it covers any action seeking to access information already stored on your terminal, or to write information to it. The browser's local storage (localStorage) therefore falls within the same scope. This policy describes all such writes, both cookies and local storage.

2. What we place on your terminal

own2pwn uses a limited number of trackers, classified into two categories:

2.1 Strictly necessary trackers

These trackers are essential to providing the service you request and are exempt from consent (art. 82 of the French Data Protection Act).

  • Authentication: session cookie, keeping you logged in
  • Security: protection against CSRF attacks, rate limiting; the contact form and booking page also use the Cloudflare Turnstile anti-bot service (see section 5)
  • Interface preferences: light / dark theme, language
  • Remembering your consent choice: your answers to the consent banner are stored in your browser's localStorage, under the key own2pwn-cookie-consent-v1. This is indeed a write to your terminal, necessary so that you are not asked again on every page and so that your refusal is respected.

2.2 Audience measurement (Plausible Analytics)

With your consent, we measure the site's audience using Plausible Analytics, which we host ourselves on our own infrastructure (analytics.own2pwn.fr, servers located in Germany): traffic data is not transmitted to any third party.

  • No cookie, no write to your terminal for audience measurement: Plausible does not set a cookie or a local identifier. (Your consent choice, however, is stored locally — see section 2.1.)
  • Your IP address is used, but not retained: it is used, together with the User-Agent header and a secret salt renewed daily, to compute a one-way hash that allows unique visitors to be counted over a given day. Neither the IP address nor the previous day's salt is retained: matching one session to another is therefore impossible.
  • Aggregated data: only non-identifying information is used (pages visited, country, browser, traffic source).

The Plausible script is only loaded if you have enabled the "Audience measurement" category in the consent banner. Without your consent, no network request is sent to Plausible.

We do not use advertising cookies or third-party trackers (Google Analytics, Meta Pixel, Hotjar, etc.).

3. Retention period

  • Session cookies (authentication): deleted when the browser is closed or the session expires
  • Interface preferences (theme, language): 13 months maximum
  • Consent choice (localStorage): 6 months, in accordance with the CNIL's recommendation. After this period, the record is erased and the banner is shown to you again — whether your previous choice was to accept or to refuse.
  • Audience measurement: no retention period on your terminal, since nothing is written there. Aggregated statistics on the server side are kept for 25 months maximum (the duration recommended by the CNIL for audience measurement data).

4. Managing your preferences

You can manage your preferences:

  • Via our consent banner shown on your first visit
  • At any time via the "Manage my cookies" link in the footer, which reopens the settings panel
  • By clearing your browser's site data, which also removes your saved choice
  • From your browser settings:

Refusing audience measurement is just as easy as accepting it, and has no consequence on your browsing.

Important: blocking strictly necessary trackers may make some features of the Site unusable (in particular, being unable to log in).

5. Third-party services

Cloudflare Turnstile is loaded on the /en/contact and /en/reserver pages to distinguish human visitors from bots. This is a security measure strictly necessary for providing the form, exempt from consent. Turnstile operates without advertising-tracking cookies, but may read and write technical information on your terminal and processes your IP address; Cloudflare, Inc. is established in the United States (see the "Transfers outside the EU" section of our Privacy Policy).

Online payment is operated by Stripe: card fields are served by Stripe, which sets its own trackers necessary to secure the transaction and combat fraud. These trackers are only loaded on payment pages.

Some pages may also load resources from third-party services (for example an embedded video). We limit the use of these services to what is strictly necessary.

6. Policy updates

This policy may be amended to reflect the evolution of our practices or of the legal framework. The date of the last update appears at the top of the page.

7. To find out more

8. Contact