This is a translation. In case of any discrepancy, the Russian version of the document prevails.
1. Why this document exists
It lists everything the Service stores in your browser: cookies and entries in local storage. Some are needed for sign-in to work, some remember the chosen theme, and some measure traffic. The last group loads only with your consent.
2. What the public website stores
The website itself (theivy.ru and theivy.dev) sets no cookies of its own; it uses local storage:
| Name | What it holds | Lifetime |
|---|---|---|
theme |
the chosen colour theme — light or dark | until the site data is cleared |
cookie_consent_analytics |
your answer in the banner: analytics accepted or rejected | until the site data is cleared |
Both entries stay in the browser and are never sent to our server.
3. Analytics — only after consent
Until you press “Accept” in the banner, no analytics script is loaded at all: the page contacts neither Yandex nor Google. After consent the following are enabled:
| Service | Identifier | What it collects |
|---|---|---|
| Yandex.Metrica (Yandex LLC) | 110744189 | a pseudonymous visitor identifier, viewed pages, referral source, device and browser details; sets its own cookies on the site domain |
| Google Analytics (Google LLC) | G-JFTH12ZDM6 | a pseudonymous visitor identifier, page view events, device and browser details; sets its own cookies |
You may opt out at any time: clearing the site data in your browser removes the consent record as well, and the banner appears again. Browser settings that block third-party cookies help too.
4. What the client area stores
The client area (app.theivy.ru and app.theivy.dev) uses no analytics. All of its cookies are functional: sign-in does not work without them.
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
access_token |
proves the request comes from a signed-in user | 1 hour | HttpOnly, Secure |
refresh_token |
renews the session so you need not sign in every hour | up to 90 days | HttpOnly, Secure |
csrf_token |
protects against cross-site request forgery | for the session | Secure, read by the client area script |
device_id |
distinguishes your devices; a block can then target one device instead of a whole network | 1 year | HttpOnly, Secure |
These cookies cannot be turned off while you stay signed in: without them the browser cannot prove that you are. Signing out deletes them.
The cookies are set on the domain zone you signed in to — otherwise the browser would not hand them to the client area. So a session on app.theivy.ru does not carry over to app.theivy.dev: the other zone needs a separate sign-in.
5. Who else sees this data
Functional cookies are handled by our server only. Analytics cookies send data to Yandex and Google, whose policies are published on their websites. No advertising networks are present on the site, and we do not sell visit data.
6. Questions
Data protection requests: legal@theivy.ru. The general processing rules are described in the Privacy Policy.