Cookies and measurement

1. Files needed to run the service

• The session cookie on the buyer and supplier platforms holds only a random identifier, not account data, and is protected from script access. The approved configuration supports sessions of up to 30 days; the actual length can be shorter depending on the configuration or when the sign-in provider's session ends or is revoked. Admin sessions are shorter: by default 15 minutes of inactivity and 4 hours at most, with extra identity checks.
• A short-lived cookie for the sign-in step (10 minutes), one that remembers the organisation you chose, and on the buyer platform one that remembers the interface language for a year.
• A temporary note in the browser session (sessionStorage) on egygomla.com so the page's entrance animation does not repeat when you come back to it.
• Where web measurement is available, a functional cookie that stores only that the consent message was shown, your choice and the terms version, for a year on the same site and browser. It holds no identifier for you or your device, and showing the message does not start measurement.

These files are needed to provide the service you ask for, such as signing in and protecting your session. They are not used for tracking or advertising and do not need your consent, but blocking them in the browser can prevent signing in.

2. Optional measurement and crash diagnostics

When these controls are available, you can choose mobile crash and performance diagnostics using Google Firebase Crashlytics and Performance Monitoring, and choose usage measurement separately. Optional controls are off by default and no optional data is sent before you consent. You can withdraw consent in privacy settings to stop subsequent collection; this does not mean previously sent data is immediately deleted.

Optional web measurement uses only a service hosted on EgyGomla servers, not an external analytics provider. Measurement is limited to predefined interface events, such as using a public button, aggregated viewing and performance durations, and safe error categories. We do not record keystrokes, field values, passwords, tokens, sessions, chat content, payment data, raw URLs or account, organisation and order identifiers.

These measurements are for service reliability and usability, not advertising or session replay. Essential security and operational logs remain separate and may continue to protect the service when optional measurement is refused.

The field restrictions above apply to measurements submitted by EgyGomla application code. Google Firebase SDKs may process technical device and installation data, such as OS and app versions and a technical installation identifier separate from your account; we do not add EgyGomla account identifiers to measurement. Flutter errors are submitted as fixed categories without original messages or stacks. Native system crash report contents are managed by the provider SDK, and universal redaction of native messages is not guaranteed; activation remains subject to a privacy configuration review.

A Flutter error category may include a limited source-location hint: a fixed identifier for a reviewed interface file and a line number valid for that release, with at most three locations. We do not send file paths, method names, error messages or original stacks. Login, chat, payment, storage and provider-package files are excluded. Hints may be unavailable in compiled builds and are not a complete crash diagnosis.

3. Phone notifications

If you turn on notifications in the app, we store the device's Firebase Cloud Messaging token encrypted. Notification text is generic, without amounts, order details or message text. You can turn notifications off in the phone settings at any time.

4. What we do not use

• No advertising cookies and no cross-site tracking.
• No third-party analytics provider on the websites, and no session-replay recording.
• No selling or sharing of browsing data for marketing.

5. Your choices

• Change your choice or withdraw consent from the «Measurement settings» link on the site or in the app's privacy settings. Declining measurement does not stop you using the service.
• Each site keeps your choice separately and it does not move to another device. Clearing browser data removes the choice, so you will be asked again.
• You can delete cookies in the browser settings; deleting the session cookie signs you out.