Cookie policy
Version 1.1 · Effective from 30 October 2026 · About 7 min read- We use only the cookies and storage that are necessary for the website and the app to work, plus a few small items that remember your choices.
- No advertising cookies, no analytics cookies and no third-party tools that would track you.
- We measure website traffic without cookies – we store only daily totals.
- Videos and recordings from YouTube, Vimeo, SoundCloud and Spotify load only when you start them yourself; only then may those services store their own cookies.
- That is why we do not ask for your consent to cookies. It is enough that we inform you about them.
1. What cookies and similar technologies are
Cookies are small files that a website stores in your browser. The browser's local storage (localStorage and sessionStorage) works in a similar way. This policy applies to the eolin.app website, to the campaign app (campaign addresses, for example the address shown on the QR codes) and to the administration. The operator is Arwell Works s.r.o.
2. Why we do not need your consent
Consent is required only for cookies that are not strictly necessary for the service you have requested (e.g. advertising or analytics cookies). All our cookies and storage entries are necessary for the service to work or to remember settings you have chosen yourself. We therefore store them on the basis of Section 89(3) of Czech Act No. 127/2005 Coll. on Electronic Communications, Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications, and Article 5(3) of Directive 2002/58/EC. If we ever wanted to use cookies that require consent, we would ask you first.
3. The eolin.app website
| Name | Type | What it is for | How long |
|---|---|---|---|
| `sb-…-auth-token` | cookie (may be split into `.0`, `.1` …) | sign-in for teachers and ambassadors; works only on eolin.app | until you sign out, at most 400 days; renewed while in use |
| `sb-…-code-verifier` | cookie (HttpOnly) | strictly necessary to complete a sign-in through the link in the e-mail securely: a one-time verification key that makes the sign-in link work only in the browser that asked for the code; set when you ask for a sign-in code (three cookies: …-code-verifier, …-flows-code-verifier and …-flow-…-code-verifier); works only on eolin.app | at most 15 minutes from your last code request – as long as the sign-in code is valid |
| `eolin_lang` | cookie | remembering your chosen language | 1 year |
| `eolin_theme` | cookie | remembering the light / dark appearance | 1 year |
| `eolin_cookie_notice` | localStorage | that you have already seen the cookie information | until deleted in the browser |
| `eolin.print-guide.…` | localStorage | which steps of printing the QR codes you have ticked off in the teacher or ambassador portal | until deleted in the browser |
4. The campaign app
| Name | Type | What it is for | How long |
|---|---|---|---|
| `sb-…-auth-token` | cookie | sign-in to your pseudonymous game profile – without it the app would not recognise the profile | at most 400 days; it becomes invalid once the profile is deleted after the campaign ends |
| `molden_ref` | cookie (HttpOnly) | set only when you open a classmate's invitation link; remembers whose link you came through so that, once you join, invitation points are credited under the Campaign rules – it is part of the invitation feature you used by opening the link | 7 days; deleted immediately once you join |
| `eolin_reminder_client` | cookie (HttpOnly) | a random key protecting the reminder form against misuse; we store only its fingerprint | 1 hour |
| `molden.intro.seen:…` | localStorage | that you have already seen the campaign introduction | until deleted in the browser |
| `molden.loops.midday:…` | localStorage | that you have already seen today's midday notification | until deleted in the browser |
| `molden.loops.rulesAcknowledged:…` | localStorage | that you tapped "Got it" on the "How to get more points" rules, so the campaign's home screen no longer offers them | until deleted in the browser |
| `molden.noQrHint.dismissed:…` | localStorage | that you hid the tip "Looks like your school has no QR codes yet" | until deleted in the browser |
| `molden.home.challengeCarouselNudged` | sessionStorage | that you have already seen the hint about scrolling through challenges | until the tab is closed |
Why the molden_ref cookie needs no consent. It is set only when you deliberately open a classmate's invitation link. It is strictly necessary to provide the service you asked for by doing so – joining the campaign through that invitation – so under Section 89(3) of Czech Act No. 127/2005 Coll. (in Slovakia, Section 109(8) of Act No. 452/2021 Coll.) it does not require consent. It holds only the invitation token and is deleted when you join the campaign, or after 7 days at the latest.
The administration (for authorised staff only) additionally uses a sign-in cookie and temporary session storage for the campaign preview.
Please note: if you delete cookies in the campaign app, you lose your game profile and it cannot be restored (see the Student privacy notice).
5. Measuring traffic without cookies
On the eolin.app website we count only daily totals: how many times each page was viewed, in which language and from which domain the visitor came, and a few aggregate registration steps. We store no cookie, IP address or browser identifier; we read the browser identification only so that we do not count bots, and we do not store it. No visitor can be identified from these totals. We keep them for 25 months. The controller is Arwell Works s.r.o. Each time a page is viewed, our server necessarily receives the IP address and browser identification. We use them only momentarily, to filter out bots and to add to the daily total, and we do not store them. The legal basis is our legitimate interest in knowing how the website is used and improving it (Article 6(1)(f) GDPR). You can object to this at privacy@arwell.works; your other rights are described in the Account privacy notice.
6. Third parties
We do not use advertising networks, social plugins or third-party analytics tools. Fonts and the website's other files are loaded from our own servers. If we link to another website (e.g. a podcast tip), its own rules apply there.
Video and audio players. Some activities in the campaign app contain a video or recording from YouTube, Vimeo, SoundCloud or Spotify. The player loads only when you tap "Play"; until then we load nothing from that service and none of its cookies is stored. Once started, the service may store its own cookies or similar records in your browser under its own policy – it, not Arwell, is responsible for them. We start YouTube in its privacy-enhanced mode (youtube-nocookie.com). If you do not start the player, no such cookies are created. More in the Student privacy notice (section 3).
Vercel's security check. The website and the campaign app are protected by the firewall of our hosting provider Vercel. If a check against bots is triggered for your request, Vercel stores the `_vcrcs` cookie once you pass it, so that it does not check you again. It is set only when the check is triggered, lasts a short time (as set by Vercel) and serves only to protect the service against attacks. It is technically necessary and therefore needs no consent.
7. How to manage cookies
You can delete or block cookies and storage at any time in your browser settings. If you block the necessary cookies, neither sign-in nor the game will work.