openXtrail sets two cookies, and both are there for one thing: keeping you signed in. A third one appears only if you sign in with Google, and is gone again as soon as that sign-in is over. Unless you sign in, this site sets no cookie at all.
No tracking, no advertising, no audience measurement, no third-party service reading along. That is why there is no cookie banner here: there is nothing we would have to ask your permission for.
The sign-in cookies
The first three appear when you sign in and are gone when you sign out. The access cookie holds your account's id and an expiry, the refresh cookie a random string, the third a 1 or a 0 — no name, no email address, nothing about your tours.
oxt_access
Identifies each request as yours. Expires after 5 minutes, applies to the whole site, and carries the attributes HttpOnly, SameSite=Lax and Secure.
oxt_refresh
Fetches a new access cookie once those 5 minutes are up — without it you would have to sign in again every few minutes. Expires 15 minutes after your last activity, or 30 days after it if you ticked “Stay signed in”. Carries the same three attributes, and is sent only to /api/auth/refresh and to no other address on this site.
oxt_remembered
Records one thing: whether you ticked “Stay signed in” — a 1 or a 0 and nothing else. The page reads it to know whether to sign you out after 15 quiet minutes, which is why it is the only one of these cookies without HttpOnly. It expires when the session does and is deleted when you sign out.
oxt_google_state
Appears only if you press “Continue with Google”. It holds a random string that also goes into the address we send you to; if the two do not match when you come back, we stop there — which is what keeps anybody from signing you into a Google account that is not yours. Lasts 10 minutes, is sent only to /api/auth/google, carries the same three attributes, and is deleted as soon as the sign-in is over, whether it worked or not.
HttpOnly means no script in the browser can read any of them. SameSite=Lax means they are not sent along when another site triggers something here in the background. Secure means they travel over an encrypted connection only.
The route planner's draft
The route planner keeps an unsaved route in your browser's sessionStorage: the waypoints, the profile, the pace you chose and, if you are editing a route you saved, its name and its id. An accidental reload is therefore no longer the end of a half-drawn loop.
It is not a cookie and it never reaches the server. The draft belongs to that one tab and is gone as soon as you close it; a route reaches our server only when you save it deliberately.
It is named here all the same, because § 25 TDDDG governs storing information on your device and not only cookies.
Why there is no cookie banner
Everything above is strictly necessary for a function you asked for yourself — staying signed in, completing a sign-in safely and not losing a draft. Storage of that kind needs no consent under § 25 (2) no. 2 TDDDG.
A banner would therefore ask permission for something that is already permitted, and pretend there is a choice to make where there is none. If we ever set something that is not necessary, we will ask first — and then the question will be a real one.
What we do not set
This list is a description rather than a statement of intent: none of it is built into this application.
No analytics and no audience measurement, neither through a third-party service nor with a counter of our own.
No advertising, no retargeting, no advertising identifiers.
No social media plugins and no like or share buttons that phone home.
No content delivery network.
No external web fonts.
No consent management platform — that is the software behind the usual banners, and it sets cookies of its own.
The map comes from our own server too: the style, the icons, the glyphs and the tiles all sit under /tiles/ on the same host as this page. So no outside map provider learns where on the map you are looking.
Managing cookies in your browser
Every browser can show cookies, delete them one by one, or block them entirely. Depending on the browser it sits under privacy, security or site settings.
If you block them, signing in stops working: the form accepts your password, and the next page considers you signed out again. That is not a warning, simply the consequence — without a cookie the server has nothing to recognise you by between two requests.
Everything that needs no account — looking at the map, planning a route — works on without cookies. And for tidying up, signing out is enough: it deletes the two session cookies for you.
Authoritative version
The German version of this cookie notice is the binding one. This English version is a convenience translation; where the two differ, the German text applies.
