PinTips

Cookie Policy

Last updated: October 12, 2026

This Cookie Policy describes the use of cookies and similar technologies by the PinTips platform (the "Service"), operated by Undici S.r.l.s. (the "Controller"), in compliance with Regulation (EU) 2016/679 ("GDPR"), the ePrivacy Directive and applicable Italian law.

This Cookie Policy should be read together with the Service's Privacy Policy.

1. What cookies are

Cookies are small text files that websites send to the user's device (computer, smartphone, tablet) while browsing, and which are then sent back to the same sites on the next visit.

Cookies allow a site to:

  • recognize the user's device;
  • store information about preferences;
  • improve the browsing experience;
  • ensure the Service works correctly.

In addition to cookies, similar technologies may be used (e.g. local storage, session storage, pixels, SDKs) that perform similar functions.

2. Types of cookies used

The Service uses the categories of cookies and similar technologies described below.

3. Strictly necessary (technical) cookies

These cookies are essential for the operation of the Service and do not require the user's consent. They include, by way of example:

  • session and authentication cookies, managed by Supabase Auth, which keep the user signed in and protect the session (technical cookies, typically httpOnly);
  • security and load-balancing cookies of the hosting infrastructure;
  • cookies needed to ensure correct page rendering.

Without these cookies, the Service could not function properly.

4. Functionality cookies and technologies

These cookies and local-storage technologies allow the Service to:

  • remember the user's preferences, including the theme preference (light/dark), stored in the browser's local storage;
  • store the user's cookie preferences;
  • maintain session state and improve the user experience.

The use of such technologies may be treated as technical cookies where strictly necessary for the operation of the Service.

5. Registration attribution cookie

On the first visit from the home page, the Service may set a first-party technical cookie (pintips_ref) that stores, where present, the registration source parameters (e.g. the ref parameter or the utm_* parameters in the link, and the hostname of the referring site — host only, never the full URL). This cookie:

  • is first-party and lasts at most 30 days;
  • is set as httpOnly;
  • is used solely to attribute any registration to its source channel, in aggregate form, and not for individual profiling.

6. Analytics and measurement cookies

The Service adopts a dual approach to measurement:

  • First-party, server-side metrics, without cookies: the number of public-map views and pin interactions is counted server-side with data-minimizing techniques (see Privacy Policy § 3.6). This measurement does not use cookies and does not track the user across different sites. The aggregate, anonymous public-map open event alone is additionally transmitted server-side to the analytics provider (PostHog), likewise with no cookies and no device storage.
  • Product analytics (PostHog), subject to consent: client-side product analytics is provided by PostHog and may use cookies or local storage. That collection is disabled by default (opt-out) and is activated only with the user's consent.

7. Third-party cookies and technologies

The Service uses components and services provided by third parties that may set cookies or use similar technologies. Such cookies are managed directly by the respective providers under their own policies, to which reference is made.

7.1 Vercel

The Service is hosted and distributed through the Vercel infrastructure, which may use cookies and similar technologies for technical, security and performance purposes.

7.2 Supabase

The Service uses Supabase for authentication and session management. Supabase may use cookies or local storage to handle authentication, maintain the session and ensure Account security. Such cookies are considered technical and necessary.

7.3 Stripe

The Service uses Stripe for payment processing and checkout. Stripe may set cookies or use similar technologies for fraud prevention, transaction security and payment management. Stripe acts as an independent data controller for the data collected through such cookies.

7.4 Google

The Service uses Google Maps Platform for maps and place search and, where the user chooses Google sign-in, the "Sign in with Google" system. Google may use cookies or similar technologies to provide such services, ensure their security and analyze their usage. Loading maps may involve the transmission of technical data, including IP addresses and geographic coordinates.

8. Local Storage, Session Storage and similar technologies

In addition to cookies, the Service may use local storage, session storage and other local-storage technologies, solely to:

  • maintain the user's state;
  • store preferences (e.g. theme, cookie consent);
  • improve performance and ensure the Service works correctly.

Such technologies are not used for profiling purposes, except for the consent-based product analytics (§ 6).

Unsaved changes to itinerary stops are kept in the tab’s sessionStorage so they can be recovered. They include map and stop identifiers, coordinates, titles and notes, separated by account and map. This local copy is removed after the changes are saved or after a successful sign-out in that tab. Session lifetime depends on the browser, which may restore tabs after closing. Drafts are not synced across devices; PinTips shows a warning if the browser prevents storage.

9. Managing and withdrawing consent

Consent is required only for the categories of cookies and technologies for which it is required by applicable law (in particular for product analytics). Strictly necessary technical cookies do not require consent.

The user may at any time manage or withdraw consent:

  • through the preferences panel below;
  • through their browser settings, by deleting or blocking cookies.

Disabling technical cookies may impair the correct operation of the Service.

10. Transfers to non-EU countries

The use of third-party services may involve the transfer of personal data to countries outside the European Economic Area. Such transfers take place in compliance with applicable law, through adequacy decisions, Standard Contractual Clauses (SCC) and further safeguards provided by the GDPR.

11. Updates to this Cookie Policy

The Controller reserves the right to amend this Cookie Policy at any time. Changes will be published on the website or within the App and will take effect from the date of publication.

12. Useful links

For more information on the processing of personal data, please refer to the Service's Privacy Policy.