We minimize the data we keep about you. This page lists every cookie, localStorage and sessionStorage entry that may exist on your device when you use EvoMap, what it is for, how long it lasts, and the legal basis for processing it. You can review or change your choice at any time via the 'Cookie preferences' link in any page footer.
1.Strictly necessary#
These items are required for the site to function. They are written regardless of your cookie banner choice; refusing them would break login, security, anti-abuse, or first-party performance analytics. This section also covers error monitoring: crash and failure reports go to Sentry, a third-party processor, which also receives a sampled slice of ordinary page timing. That is not gated by the banner either; the rows named for Sentry below spell out exactly what it receives.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| evomap_sid | Cookie | Login session token | 30 days (Max-Age in src/lib/cookie.js) | GDPR Art. 6(1)(b) — contract performance |
| evomap_user | localStorage | User profile cache (reduces /me request frequency) | Persistent (cleared on logout) | Art. 6(1)(b) |
| evomap_auth_ts | localStorage | 401 grace-period timestamp (prevents short-network-blip logout) | Persistent | Art. 6(1)(b) |
| evomap_chunk_reload | sessionStorage | Auto-recovery from post-deploy chunk-load errors | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (deployment stability) |
| evomap_chunk_reload_reported | sessionStorage | Marks the reload above as already reported, so one post-deploy recovery produces one diagnostic event instead of one per document | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (deployment stability) |
| sentryReplaySession | sessionStorage (Sentry SDK) | Session Replay id. The SDK keeps a rolling recording of roughly the last 60 seconds in your browser's memory and it stays there: nothing is uploaded unless a JavaScript error happens, and then that buffered minute is sent so we can see what led up to the crash. An ordinary visit that never errors uploads no replay at all. Throughout, the SDK's masking defaults are left on: every text node and every form input is replaced with a placeholder and all media is blocked, so what we receive is layout and interaction timing, not what you typed or read | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (diagnosing crashes) |
| sentry_performance_trace | Third-party transmission to Sentry (sentry.io) — not browser storage | Separately from the error reporting below, a sample of ordinary page loads and in-app navigations (20% in production) is timed and sent to Sentry so we can see when the site gets slower. A trace carries the page URL, timings and the same anon_id / session_id, not page content — no replay is recorded and nothing you typed is included | Per the Sentry project's retention setting; deletable on request | Art. 6(1)(f) — legitimate interest (service performance) |
| sentry_error_event | Third-party transmission to Sentry (sentry.io) — not browser storage | When a page crashes, or a critical path fails for a reason on our side (login, page load, an API call our server could not complete), we send Sentry the error type and stack trace, the page URL, your browser and OS, the preceding interaction breadcrumbs, and the identifiers evomap_anon_id / evomap_session_id plus your account id when you are signed in — the same identifiers our own analytics uses, so one report can be matched to one session. A failure caused by your own input, such as a wrong password or a rate limit, does not create a report of its own; it can still appear as one line of context inside a later report, because we record every failure as a breadcrumb before deciding which ones to send. Sentry's privacy policy: https://sentry.io/privacy/ | Per the Sentry project's retention setting; deletable on request | Art. 6(1)(f) — legitimate interest (service reliability and security) |
| evomap_ai_chat_quota | localStorage | Anti-abuse rate limit for the AI chat surface | Persistent | Art. 6(1)(f) — anti-abuse |
| evomap_storage_warned | sessionStorage | Storage-error telemetry dedupe (≤ 1 warn per 24h per tab) | 24h cooldown; cleared on tab close | Art. 6(1)(f) |
| evomap_consent | localStorage | Your cookie-preference decision (so we don't re-ask every visit) | 90 days | GDPR Art. 7 — consent record |
| evomap_consent_expired | localStorage | Single-shot marker so we know to re-prompt after TTL expiry | Short-lived (cleared on next banner mount) | Art. 7 |
| evomap_exp_evox_beta | Cookie (HttpOnly) | Keeps you on one version of the EvoX download page across visits and languages while we compare two layouts — first-party, anonymous, never shared with third parties | 90 days | Art. 6(1)(f) — first-party content variant (D-7 Plan X, extended) |
| evomap_anon_id | localStorage | Anonymous identifier for site performance improvement. It is not shared with advertising or analytics third parties, and it is never sold; the one processor that receives it is our error monitor (see the sentry_error_event row), so that a crash report can be matched to the session it came from | Persistent | Art. 6(1)(f) — first-party analytics (ICO / AEPD position) |
| evomap_im_ref | Cookie | First-party Impact.com affiliate click id (`im_ref`) for last-click conversion attribution — never shared with third parties from the browser; forwarded only on our own auth/billing requests. When an attributed conversion completes, our server submits the click id together with conversion identifiers and amounts to Impact.com's conversion reporting API, to settle the partner's commission. | 90 days | Art. 6(1)(f) — first-party attribution (affiliate conversion) |
| evomap_session_id | sessionStorage | First-party session identifier — rotates every 30 min of inactivity | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_session_ts | sessionStorage | Last-activity timestamp paired with evomap_session_id (drives idle rotation) | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_utm | sessionStorage | Marketing-campaign entry attribution — current session only | Session (cleared on tab close) | Art. 6(1)(f) |
| evomap_pending_credit_purchase | sessionStorage | Temporary checkout-return context for credit top-ups: selected credit amount, USD amount, and Hub order id. It never stores card numbers, payment tokens, or provider secrets. | Session; removed after the credit-purchase result return is processed | Art. 6(1)(f) — payment attribution and support diagnostics |
2.Functional#
Items that store user preferences you actively chose (language, theme, AI chat history).
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| evomap_locale | Cookie + localStorage | Your selected language | 1 year | Art. 6(1)(a) — user-initiated preference |
| evomap_theme | Cookie + localStorage | Your selected theme | 1 year | Art. 6(1)(a) |
| evomap_ai_chat | localStorage | AI chat history (local only — never uploaded) | Persistent | Art. 6(1)(b) — user-generated content |
| evomap_onboarding | localStorage | Onboarding-tour completion state | Persistent | Art. 6(1)(f) |
3.Analytics (third-party — togglable)#
Google Analytics 4 cookies. Default-denied in strict regions (EU/EEA/UK/Switzerland, EU microstates, UK Crown Dependencies, Brazil, South Korea, Japan, Türkiye, Israel — plus any visitor whose country cannot be resolved); default-granted elsewhere with no banner shown. Strict-region visitors toggle via the cookie banner; other visitors can open the panel via the 'Cookie preferences' link in the footer. We also store an irreversible hash of the email address you enter at registration in our own first-party database for conversion-funnel analysis; this hash is never shared with Google.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| _ga | Cookie (Google SDK, written on our domain) | Google Analytics 4 visitor identifier | 2 years | Art. 6(1)(a) — explicit consent (banner) |
| _ga_<id> | Cookie (Google SDK, written on our domain) | Google Analytics 4 property-scoped session | 2 years | Art. 6(1)(a) |
| _gid | Cookie (Google SDK, written on our domain) | Google Analytics 4 short-term visitor distinguisher | 24h | Art. 6(1)(a) |
| analytics_event_client_ip | Server-side database field (evomap_behavior_events.properties.client_ip — plaintext IP address) | The visitor IP address our edge resolved for the request that reported the event, stored so abuse and traffic-quality investigations can identify the originating network. Recorded only when the ingress can vouch for the address; internal and gateway addresses are never stored. Not forwarded to Google. | Retained for the analytics table's retention window; deletable on request | Art. 6(1)(f) — legitimate interest (fraud prevention and service security) |
| analytics_event_geo_country | Server-side database field (evomap_behavior_events.geo_country — ISO alpha-2) | Country our edge resolved for the request that reported the event, used for traffic-quality and funnel analysis by region. | Retained for the analytics table's retention window; deletable on request | Art. 6(1)(f) — legitimate interest (product analytics) |
| analytics_event_email_hash | Server-side database field (evomap_behavior_events.properties.email_sha256 — irreversible SHA-256 hash) | Irreversible hash of the email entered at registration intent / completion (register_button_click, register_create_account_result) for conversion-funnel analysis. Stored only in our first-party database; the plaintext email is never persisted to analytics and never forwarded to Google. | Retained until account deletion; deletable on request | Art. 6(1)(f) — legitimate interest (product analytics) |
4.Advertising (third-party — togglable)#
Google Ads conversion-tracking cookies, split into three Google Consent Mode v2 axes (ad_storage, ad_user_data, ad_personalization) you can toggle independently — plus Meta Pixel cookies (_fbp, _fbc). Same default policy as analytics. Meta is a separate data controller and sits outside Google Consent Mode, so it has its own switch on the ad_storage axis: turning Advertising off revokes Meta's consent too. Unlike the Google cookies above, _fbp and _fbc exist precisely to match your activity here to your ad clicks on Meta's platforms, across sites.
| Name | Type | Purpose | TTL | Legal basis |
|---|---|---|---|---|
| _gcl_aw | Cookie (Google Ads SDK) | Google Ads conversion attribution | 90 days | Art. 6(1)(a) |
| _gcl_au | Cookie (Google Ads SDK) | Google Ads conversion linking | 90 days | Art. 6(1)(a) |
| _gcl_dc | Cookie (Google Ads SDK) | Google Ads display network | 90 days | Art. 6(1)(a) |
| _fbp | Cookie (Meta Pixel) | Meta ads conversion attribution — browser identifier | 90 days | Art. 6(1)(a) |
| _fbc | Cookie (Meta Pixel) | Meta ads click attribution — set when arriving via an ad click | 90 days | Art. 6(1)(a) |
5.Third-party account connectors (Google Drive and Gmail)#
When you connect a Google Drive or Gmail account to your EvoMap account from the EvoX console, we request the permissions listed on Google's OAuth consent screen, where you can see each one and decide whether to grant it. A connection only happens when you click Connect, and you can disconnect at any time.
- What we access: Google Drive — file metadata, contents, and permissions, read-only (drive.readonly), plus files this app itself creates or opens (drive.file), which also lets EvoX create and copy files in your Drive when you ask it to. Gmail — read-only access to threads, message bodies, labels, and drafts (gmail.readonly); EvoX cannot send, modify, or delete your mail. We also receive your Google account's email address (openid, email), used only to label the connection so you can tell two connected accounts apart. Your data is read on demand only when you start a task in EvoX that needs it, and only to complete that task; any action that would change something in your Drive requires a separate confirmation from you each time.
- Where it lives: authorization tokens are stored encrypted on EvoMap's servers; they are never written to your device and never appear in logs. File and email contents pass through our servers only while your request is being handled and are not persisted there; the server keeps an audit digest (a hash) of each operation, not the content. The connection record itself holds your account's email label, the permissions you granted, and when it was last used. Content returned by a tool appears in your conversation history, which is kept inside the EvoX app on your own machine.
- How long: access and refresh tokens are kept until you disconnect, so you do not have to re-authorize on every device. Disconnecting erases both from our systems immediately.
- How to revoke: click Disconnect on the Plugins page of the EvoX console at any time. We erase our copy of your tokens first, then ask Google to revoke the grant, and we tell you if Google refuses rather than showing you a disconnection that did not fully happen. You can also revoke access directly from the third-party access page of your Google Account. After disconnecting we hold no usable access or refresh token.
- No sharing: data obtained from Google APIs is never sold, rented, or provided to third parties, and is not used for advertising. EvoMap's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6.Your rights#
Under GDPR you can withdraw consent at any time, request a copy of your data, request deletion, and complain to a supervisory authority. Email [email protected] for any data request.
7.Contact#
Operator: EVOMAP PTE. LTD. General questions and data requests: [email protected].