LEGAL
GapLap | Cookie Policy
Last reviewed:
1. Who we are and where this policy applies
ZOREVIA LIMITED (“Zorevia”) (HE 498835), incorporated in the Republic of Cyprus, provides GapLap. This policy covers the public website at https://gaplap.com and the application at https://app.gaplap.com, including shared QR previews. These addresses have separate browser storage.
This policy explains browser technologies and external resources used with GapLap. It supplements the Terms of Use and Privacy Policy; it does not change their provisions. General enquiries: support@gaplap.com. Personal data enquiries: privacy@gaplap.com.
2. Cookies and browser storage
HTTP cookies are small values a browser stores and may send with requests to the relevant website. localStorage keeps values for a website origin across browsing sessions. sessionStorage keeps values for a website origin within a tab’s page session, generally until that session ends. Browser settings can limit or clear these technologies.
The application storage entries listed below are localStorage or sessionStorage, not HTTP cookies. A third-party request does not by itself establish that a cookie is set. Cookie names, providers, host domains and precise lifetimes cannot be inferred from browser-storage identifiers.
3. Necessary and optional technologies
The application’s consent settings distinguish strictly necessary storage (always on) from optional external content (off by default until explicit consent). Necessary storage supports requested functions such as authentication, security, consent choices and continuity of work. Optional sender-logo lookups and Google Maps embeds are controlled by the application’s external-content choice. The separate QR and campaign-media requests described below are not all covered by that choice.
Access to or storage of information on a device is subject to the applicable rules implementing Article 5(3) of the ePrivacy Directive, including its strictly necessary exception. The EDPB’s final Guidelines 2/2023, adopted on 16 October 2024, address its technical scope. Where personal data are involved, the GDPR also applies, as explained in the Privacy Policy. A first-party label alone does not make every use exempt from consent.
No third-party analytics SDK is configured in the application’s current consent implementation. This is not an exhaustive inventory of website, application or hosting requests, cookies or analytics, and does not establish that optional marketing analytics is running.
| Category | Purpose | Default / choice |
|---|---|---|
| Strictly necessary | Requested authentication, security, consent choices and essential session functions. | Always on in the application’s consent settings; the legal exception depends on the purpose. |
| Optional external content | App-controlled sender-logo lookups and Google Maps embeds. | Off by default until explicit consent; change or withdraw through app Cookie settings. |
4. First-party application storage
The table identifies browser-storage entries in the application implementation, their purposes and clearing criteria. All listed entries are first-party application storage provided by GapLap / ZOREVIA LIMITED. It is not a complete browser-cookie or network inventory across the website, application, authentication and payment flows. No precise HTTP-cookie lifetime is asserted here.
Restore eligibility is not physical deletion. Browser storage may remain after a feature stops using it, and interrupted imports may leave pending data behind. Clearing local storage can remove drafts, preferences and sign-in state; clearing session storage can remove pending actions.
Two listed entries — the provider-discovery event queue and the provider-pattern metadata — support product functionality in the application. Their classification as strictly necessary storage or as requiring consent has not been determined and is subject to legal review before publication. These entries are identified from application source code; source code does not by itself prove runtime HTTP cookies or response headers.
| Identifier / key family | Type | Origin | Purpose | Duration / clearing |
|---|---|---|---|---|
| gaplap_consent | localStorage | https://app.gaplap.com | Versioned, timestamped optional-content preference. | Until changed or browser storage cleared; no fixed TTL. |
| sb-...-auth-token (SDK key family) | localStorage | https://app.gaplap.com | Persistent Supabase authentication tokens and session state; key family subject to SDK updates. | Managed by the authentication SDK lifecycle, sign-out and browser clearing; no confirmed fixed expiry. |
| emu_draft_autosave | localStorage | https://app.gaplap.com | Automatically saved campaign JSON for restoring work. | Eligible for restore for 1 hour; older physical storage may persist until deletion or browser clearing. Restore eligibility is not deletion. |
| gaplap_pending_checkout_interval | sessionStorage | https://app.gaplap.com | Pending monthly or annual checkout intent only; not payment card data. | Until consumed, cleared or the tab’s page session ends. |
| rcs_allowed_previews | localStorage | https://app.gaplap.com | Preview-domain preference. | Until the choice or storage version changes, or browser storage is cleared; no fixed TTL verified. |
| rcs_domain_memory_v | localStorage | https://app.gaplap.com | Version marker for preview-domain preferences. | Until the storage version changes or browser storage is cleared; no fixed TTL verified. |
| pending_campaign_data | localStorage | https://app.gaplap.com | Pending campaign JSON awaiting import or consumption. | Removed after successful consumption; may linger if interrupted, until consumed or browser storage cleared. No fixed TTL verified. |
| staged_upload_data | localStorage | https://app.gaplap.com | Staged JSON/import data awaiting consumption. | Removed after successful consumption; may linger if interrupted, until consumed or browser storage cleared. No fixed TTL verified. |
| emu_guest_uploads | localStorage | https://app.gaplap.com | Guest-upload usage count. | Persists until browser clearing or qualifying account-data clearing; no fixed TTL in source. |
| emu_demo_loaded_v1 | localStorage | https://app.gaplap.com | Demo-loaded state marker. | Persists until browser storage cleared; no fixed TTL in source. |
| emu_walkthrough_done_v1 | localStorage | https://app.gaplap.com | Walkthrough completion state marker. | Persists until browser storage cleared; no fixed TTL in source. |
| emu_provider_discovery_queue | localStorage | https://app.gaplap.com | Local queue of up to 50 structured provider-discovery event summaries (classification, counters, hashes, timestamps, provider label); no raw campaign payload. | Persists until browser storage cleared; no fixed TTL in source. |
| emu_learning_data_v1 | localStorage | https://app.gaplap.com | Client-side provider-pattern metadata: structural key paths and usage/session counts, with timestamps. | Persists until reset, import or browser storage cleared; no fixed TTL in source. |
Observed production HTTP cookies
These HTTP cookies were observed in production HTTP responses during an isolated, fresh-browser anonymous Playwright audit on 12 October 2026. They are separate from the localStorage and sessionStorage entries above. The responses indicate hosting/edge-delivered cookies; exact controller/provider attribution, purpose and necessity basis require verification. The attributes below report observations, not verified purposes or a legal classification.
| Cookie name | Production host | Observed lifetime attributes | Observed security attributes |
|---|---|---|---|
| __dpl | gaplap.com | Max-Age=86400 seconds (1 day). | Secure; SameSite=Lax; not HttpOnly. |
| __cf_bm | gaplap.com | Expires attribute observed; no Max-Age observed. No fixed numeric TTL established. | HttpOnly; Secure; SameSite=None. |
| __dpl | app.gaplap.com | Max-Age=604500 seconds (6 days, 23 hours and 55 minutes). | Secure; SameSite=Lax; not HttpOnly. |
| __cf_bm | app.gaplap.com | Expires attribute observed; no Max-Age observed. No fixed numeric TTL established. | HttpOnly; Secure; SameSite=None. |
Cloudflare’s cookie documentation (https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/, reviewed 13 October 2026) describes __cf_bm, observed on both gaplap.com and app.gaplap.com, as the cookie placed by Cloudflare’s bot-management products and states that it expires after 30 minutes of continuous inactivity by the end user. That is a vendor statement about purpose and lifetime, not a GapLap measurement: the audit above recorded an Expires attribute and no numeric Max-Age for __cf_bm, so no fixed lifetime has been established from GapLap’s own responses. Whether __cf_bm is strictly necessary for GapLap, and the provider and controller arrangements behind it, have not been verified. The __dpl cookie is not attributed to any provider; its vendor, purpose and necessity remain unverified.
The production guest run observed Google Fonts requests to fonts.googleapis.com and fonts.gstatic.com on gaplap.com. On the first load of the app homepage, the observed localStorage keys were emu_demo_loaded_v1, emu_draft_autosave, emu_learning_data_v1 and rcs_domain_memory_v. These observations are not an exhaustive account, session or network inventory. Google OAuth, Stripe TEST and QR network behavior remain unresolved by this audit.
Lovable editor-preview redirect cookies on lovable.dev, including USER_COUNTRY and rs_visitor_id, are outside this production GapLap cookie inventory.
5. External resources and requests
The following resources are requested in the circumstances shown. An external host may receive standard request metadata, such as an IP address, browser or device information and, depending on browser settings, referrer information. Its own notices govern its processing and any cookies it sets; this table does not assert verified third-party cookie names or lifetimes.
QR preview viewers may directly fetch an already-selected remote brand_logo, including a Wikimedia-hosted image, without first opting into the editor application’s optional-content setting. Campaign media can also load from user-selected remote hosts. Consent for sender lookups does not cover all user-opened external media. The lookup does not send campaign JSON or the secure QR token to Wikidata. The Privacy Policy explains personal-data handling; external QR and media requests require separate consideration from editor consent choices.
| Resource | Host / provider | When requested |
|---|---|---|
| Google Fonts | fonts.googleapis.com / fonts.gstatic.com | Website pages load the font stylesheet and font resources independently of the application’s optional-content setting. |
| Google sign-in | Google-operated authentication services | When the user chooses Google sign-in; Google’s authentication and session notices apply. |
| Signed-in profile avatar images | lh3.googleusercontent.com | On authenticated workspace pages, the signed-in profile avatar may be requested directly from Google’s image host, even when the application’s optional sender-logo and map-embed content switch is off. This request is separate from optional brand-logo discovery and map embeds. The applicable legal basis, whether it is strictly necessary, and third-party processing still require privacy and legal assessment. |
| Stripe | Stripe-operated payment interfaces | When the user chooses payment or subscription interactions; not necessarily on first page load. |
| Wikidata / Wikimedia Commons sender lookup | www.wikidata.org / commons.wikimedia.org | App-controlled sender lookup and logo retrieval after explicit optional-content consent. |
| Google Maps | Google Maps embed services | App-controlled map embeds after explicit optional-content consent. |
| QR preview logos and campaign media | Already-selected remote logo and user-selected media hosts, including Wikimedia | Opening a QR preview or campaign media may fetch remote resources directly, without prior editor optional-content consent. |
| Product Tour | GapLap-hosted media | The website’s self-hosted video and poster; not a YouTube embed. |
6. Consent and withdrawal
Use the application’s Cookie settings to enable, disable or withdraw permission for app-controlled optional external content, including after a previous acceptance or refusal. Refusing optional content does not prevent use of core functionality. Withdrawal stops future app-controlled optional requests; it does not undo earlier requests or delete information held by an external provider.
The preferences action below opens the application’s settings in a new tab. It changes the choice saved on the application origin only, not on gaplap.com. This website’s Cookie Policy is information only: the Foundation website has no cookie preferences manager and cannot change the application’s browser storage. QR previews and user-selected external media are separate from the editor’s optional-content control.
7. Browser controls
Use your browser’s privacy or site-data settings to inspect, block or clear cookies, localStorage and sessionStorage separately for the website, application and third-party domains. These controls are separate from the application’s optional-content preference. Clearing one origin’s storage does not clear another’s.
Blocking necessary technologies can affect sign-in, security, session continuity and saved work. Browser controls may also restrict external requests. Clearing browser storage does not itself delete account-held projects or data already received by external providers.
8. Retention and personal data rights
Browser-storage retention follows the criteria in the table, not subscription or cloud-data deadlines. Privacy Policy Articles 7 and 12 govern account-held data and cloud projects. Article 12’s deletion from active systems no later than thirty (30) days after account closure, subject to its stated exceptions, is not a browser-storage TTL. Terms of Use Article 7’s thirty-calendar-day cancellation notice and refund provisions concern subscriptions, not cookie expiry.
Where identifiers or external requests involve personal data, the Privacy Policy explains purposes, legal bases, recipients, transfers, retention, access, correction, erasure, restriction, objection, portability and complaint rights, as applicable. Contact privacy@gaplap.com for personal-data requests and support@gaplap.com for general enquiries.
9. Policy review and changes
The last-reviewed date records this policy’s review, not its effective or publication date. Changes to storage, external resources or preference controls may require updates. An effective date will be stated when the policy is released, and subsequent changes will be identified on this page.