Cookie and browser storage policy

Last updated: 18 October 2026 · version 2026-10-18.1

Information translation. This is a complete information translation. If there is a discrepancy, the Polish version is legally binding.

A cookie is automatically attached to requests to a matching domain. localStorage and sessionStorage do not send values by themselves, but site JavaScript can read them and transmit them to a stated endpoint. The table says when that occurs.

1. Active-mechanism matrix

Name and type	Contents / reading and transmission	Purpose, category and recipient	Retention and removal
`dzialka_cookie_consent_v2` localStorage, schema v3	necessary/analytics/ads choice, version, `timestamp` and `expiresAt`. Read locally and not sent to an API.	Remembering the decision; necessary to respect the choice.	180 days; automatically invalid after expiry. Remove site data.
`pw_fp` HttpOnly cookie	Random 128-bit value; the browser sends it to InfoGrunt. No UA/screen/language components.	CSRF and short queue/report protection requested by the user; necessary, first-party InfoGrunt/SeoHost.	30 days; remove site data. Server: CSRF 24 h, queue up to 1 h, report log without a signed-in account 30 days.
`__Host-pw_sess` HttpOnly cookie	Random session secret; the server stores only SHA-256.	Optional sign-in and account functions; necessary after sign-in.	30 days, sign-out or account deletion.
`pw_lc` HttpOnly cookie	Random marker of the browser that requested a sign-in code (the server knows only its SHA-256).	The emailed code works only in that browser — protects against sign-in blocking.	15 minutes or until sign-in.
`pw_goauth` HttpOnly cookie	Signed random state, nonce and PKCE verifier, sent only to the InfoGrunt sign-in callback; HttpOnly, Secure, SameSite=Lax.	Protection of Google sign-in selected by the user.	10 minutes and removed after callback.
`pw_qa` cookie	Value `1`, read by JS/API and sent as a cookie/QA marker.	Explicit `?qa=1` only; separates technical tests.	180 days; `?qa=0` or cookie removal.
`kroltech_owner` cookie	Value `1`, no identifier; created only after opening a special link with `?kt_owner=1`.	The site owner uses it on his own devices so that his visits are not counted in the statistics.	400 days; `?kt_owner=0` or cookie removal.
`ig_browser_nonce_v1` localStorage	Random ID, creation and expiry. After consent, JS sends the ID to `/api/pageview.php`.	First-party analytics; analytics consent. Recipient: InfoGrunt/SeoHost.	180 days or earlier withdrawal. Server HMACs and raw pageview: 30 complete days.
`ig_campaign_attribution_v1`, `ig_campaign_landing_pageview_v1` sessionStorage	Allowlisted UTMs and click-ID presence flags; JS sends them to `/api/pageview.php` and `/api/track/ping`. No click-ID values.	Campaign analytics; analytics consent. InfoGrunt/SeoHost.	Tab session or withdrawal; raw server records 30 days.
`dzialkaRecent` localStorage	Up to five queries, label, lat/lng and timestamp. The list is not sent; choosing an item starts geocoding/report use.	User-requested recent-search convenience.	30 days with automatic cleanup; remove site data.
`ig_v_YYYY-MM-DD`, `ig_pop_YYYY-MM-DD` localStorage	Local support-message counter/flag; never sent.	Local frequency control.	Seven days with automatic cleanup.
`ig_edit_reload_<id>` sessionStorage	`1` flag; the value is not transmitted.	One-use protection against a listing-edit reload loop.	Tab session or completion of editing.
`_ga`, `_ga_*`	Google Analytics identifiers.	Only after analytics consent and with active GA4; Google.	Active Google configuration, no more than the period configured there; removal attempt on withdrawal.
`__gads`, `__gpi`, `IDE`, `NID`	Google advertising identifiers.	Only after advertising consent and with active AdSense; Google.	Google configuration; accessible cookies are removed on withdrawal where possible.
`FCCDCF`, `FCNEC`, `euconsent-v2`	Local Google CMP choices or message state, read by Google CMP.	After the local ads choice allows Google to load. Not an InfoGrunt analytics identifier.	According to CMP configuration; accessible cookies are removed on local ad withdrawal. Partner choices can be changed in the Google CMP interface.

One consent window — the Google message. Consent is collected by Google’s certified consent management platform (TCF); we do not show a separate InfoGrunt banner. In the window you can accept, refuse or open “Manage options” to choose purposes and partners. The site works the same whatever you choose. With consent, Google may show personalised or non-personalised ads. If you refuse, we show limited ads: Google does not store advertising cookies or identifiers on your device and does not personalise ads, but it receives, among other things, your IP address and browser information needed to serve the ad. Analytics (the identified InfoGrunt counter and Google Analytics 4) runs only when you allow Google storage on your device and content measurement (TCF purposes 1 and 8) in the Google message. There are no ads in the report print/PDF, forms, the account or legal pages; on the map and in the parcel report ads sit only in dedicated places next to the content, never on the map. You can change consent at any time with the “Cookie settings” link in the footer, which reopens the Google message. This document does not state that AdSense is currently active.

2. Retired and test-only names

infogrunt_fp, dzialkaRadarSessionId, dzialkaLang*, infogrunt_theme, ig_lang, locale and lang are retired; active code removes rather than creates or transmits them. dzialka_unlock_token, dzialka_csrf, infogrunt_donate_dismissed_until and infogrunt_reports_count_for_donate exist only in unloaded legacy paywall.js. kt_fp_infogrunt.pl_day_v1 belongs to unloaded legacy traffic.js, which is also protected by analytics consent and DNT. Fixture identifiers such as __INFOGRUNT_QA_DEVELOPMENT_STATE are not part of the production bundle.

3. Consent variants

Refusal in the Google message: no nonce, campaign, GA4 or GTM; limited ads without advertising cookies; only an anonymous pageview is counted, without cookies or storage on your device (see the privacy policy, section 3).
Accept all: analytics (counter and GA4 when configured) and Google ads according to the purposes.
Partial choice (“Manage options”): analytics only with purposes 1 and 8 for Google; ads according to the selected purposes, limited ads without consent.
Withdrawal (“Cookie settings” link in the footer): blocks future initialisations/requests and removes available first-party identifiers.
DNT: analytics remains blocked.

An unknown, old or corrupted record is not consent and shows the choice again. Opening settings preserves the current choice until a new selection is explicitly saved. We cannot unload a script that has already been fetched or undo a completed request.

4. External domains and transfers

Domain	When and why
`tile.openstreetmap.org`, `nominatim.openstreetmap.org` (OpenStreetMap Foundation, United Kingdom)	Base map, search and the address of a selected point; the provider sees the technical request and connection IP.
`tiles.openfreemap.org`	Hybrid base map.
`server.arcgisonline.com` (Esri, USA)	Satellite imagery on the map, in the report and in the account.
`photon.komoot.io`	Address suggestions in search.
`mapy.geoportal.gov.pl`, `uldk.gugik.gov.pl`, `integracja.gugik.gov.pl` (GUGiK)	Orthophoto map, parcel boundaries and official layers.
`www.google.com/maps`	Only after you click a route link.
`www.googletagmanager.com`, `www.google-analytics.com`	GA4 only after analytics consent and with an active configuration.
`pagead2.googlesyndication.com` and DoubleClick domains	The Google consent message and the AdSense tag load when a page with ads opens; without consent only limited ads (no advertising cookies).

Before a choice, after refusal, or after withdrawal, we do not load Google Analytics or Google Tag Manager and no advertising identifiers are stored; only the consent message and the limited-ads tag connect to Google. Google services may process data outside the EEA under mechanisms stated in their policy, including an adequacy decision or SCCs.

5. Controller

KrolTech Łukasz Król (sole proprietorship registered in Poland)
Electronic address: kontakt@infogrunt.pl
Full service provider details (address, tax ID): kroltech.eu

Rights and the full processing description are in the Privacy Policy.