Cookie Settings
Only strictly necessary cookies are set without your consent. Everything else runs solely on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG) and can be changed here at any time.
Your choice
Loading your saved choice…
Cookies and local storage we use
Last updated: 25 August 2026. Entries marked “consent” are only set once you allow the matching category.
| Name / service | Provider | Purpose | Duration | Category | Legal basis |
|---|---|---|---|---|---|
| sb-*-auth-token (local storage) | UNLOCKY / Lovable Cloud | Keeps you signed in and authorises requests to your account data. | Until sign-out, max. 1 year | Strictly necessary | § 25(2) TTDSG, Art. 6(1)(b) GDPR |
| unlocky.guest.* (local storage) | UNLOCKY | Guest access token so a buyer without an account can reopen a paid Unlock. | 30 days | Strictly necessary | § 25(2) TTDSG, Art. 6(1)(b) GDPR |
| unlocky.cookie-consent (local storage) | UNLOCKY | Stores your cookie decision plus date and version as documentation of consent. | 12 months | Strictly necessary | § 25(2) TTDSG, Art. 6(1)(c) GDPR |
| __stripe_mid / __stripe_sid | Stripe Payments Europe, Ltd. | Fraud prevention and secure processing of the checkout, set only on payment pages. | 1 year (mid) / 30 minutes (sid) | Strictly necessary | § 25(2) TTDSG, Art. 6(1)(b) GDPR |
| unlocky.pref.* (local storage) | UNLOCKY | Remembers interface preferences you set yourself (e.g. layout, last used view). | 6 months | Functional (consent) | Art. 6(1)(a) GDPR, § 25(1) TTDSG |
| Unlock view events (server-side, no cookie) | UNLOCKY | Counts anonymous page views of an Unlock so creators see reach statistics. Only sent after analytics consent. | Aggregated, deleted with the Unlock | Analytics (consent) | Art. 6(1)(a) GDPR, § 25(1) TTDSG |
| unlocky.marketing.* (local storage) | UNLOCKY | Reach and campaign measurement. Reserved — currently no marketing tool is active. | Max. 6 months | Marketing (consent) | Art. 6(1)(a) GDPR, § 25(1) TTDSG |
Third-party services
| Name / service | Provider | Purpose | Duration | Category | Legal basis |
|---|---|---|---|---|---|
| Stripe Checkout | Stripe Payments Europe, Ltd., Ireland | Payment processing, fraud prevention, Apple Pay / Google Pay. | See Stripe cookies above; transaction data 10 years (tax law) | Strictly necessary | Art. 6(1)(b) and (c) GDPR |
| Lovable Cloud (Supabase) hosting, database, media storage | Supabase / Lovable, EU region | Operating the platform, accounts, media delivery, server logs. | Server logs max. 30 days; account data until deletion | Strictly necessary | Art. 6(1)(b) and (f) GDPR, Art. 28 GDPR |
| Resend | Resend, Inc., USA (SCCs) | Transactional emails: sign-up, password reset, purchase and payout notifications. | Delivery logs max. 30 days | Strictly necessary | Art. 6(1)(b) GDPR, Art. 28 GDPR |
Stripe Payments Europe, Ltd. (Ireland) processes payments; transfers to Stripe, Inc. (USA) are covered by EU standard contractual clauses. Resend (email delivery) and our hosting / database provider act as processors under Art. 28 GDPR. We do not use Google Analytics, Meta Pixel or comparable advertising trackers.
Legal basis and withdrawal
Strictly necessary cookies and storage are used under § 25(2) TTDSG and Art. 6(1)(b)/(f) GDPR (performance of contract, security). Everything else — including analytics events such as Unlock view counting — is only used on the basis of your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG and is never sent to our servers without it. You can withdraw your consent at any time with effect for the future — use “Withdraw consent” above. Withdrawal does not affect the lawfulness of processing carried out before it. Further information is available in our Privacy Policy.
Last updated: 20 August 2026