This policy lists the cookies and other information that the bottlechallenge.org website and the BottleChallenge app store on your device, explains what they are for and describes how to change your decision.
Cookies are small text files that a website stores in your browser. The browser’s local storage (localStorage), session storage (sessionStorage) and an app’s storage on a phone work in a similar way. This policy describes all of these ways of storing information on your device.
The service is run by the BrainGreen Foundation. How personal data is processed is described in the Privacy Policy.
2. When consent is needed
Under Article 5(3) of Directive 2002/58/EC and Article 399 of the Polish Electronic Communications Law, storing information on a device or reading it requires consent unless it is strictly necessary to provide a service you have expressly asked for. Without consent the website therefore stores only what it needs in order to work: your choice in the banner, your sign-in, the language version you chose and helper data for particular features. Analytics tools run only after you consent.
The website uses no advertising cookies, does not track you on other websites and does not pass information from cookies on for advertising.
3. Categories
3.1. Strictly necessary
Cookies and keys needed for the website and the features you use to work: remembering your choice in the banner, keeping you signed in, the language version, securing Google sign-in, invitations and the location question on the map. They need no consent and cannot be switched off in the banner. You can delete them in your browser settings, but the website may then stop working properly.
3.2. Functional
The banner has a “Functional cookies” switch. At present the website stores no cookie or key that depends on this switch, so choosing this category changes nothing.
3.3. Analytics
Google Analytics 4 shows which pages are visited and how long visits last. Google gives the browser a random identifier. The Foundation does not link it to any account, but it is personal data under the GDPR, which is why it needs consent. The Google Analytics script loads only once you choose “Accept all” in the banner, or switch on “Analytics cookies” and save your choice. According to Google, Google Analytics 4 does not store IP addresses.
4. Cookies and keys on the website
4.1. Cookies of bottlechallenge.org
Name
Purpose
Duration
Category
bc-cookie-consent
Remembers your choice in the banner: the categories chosen, the policy version and the time
365 days
Strictly necessary
bc-auth-storage
A marker that this browser has an active sign-in
30 days, deleted on sign-out
Strictly necessary
bc_lang
Remembers the language version you chose or opened, so that further pages appear in that language
365 days
Strictly necessary
4.2. Cookie of the api.bottlechallenge.org server
Name
Purpose
Duration
Category
bc_rt
The session refresh token after you sign in on the website. Website scripts cannot read it (HttpOnly) and it is sent only to api.bottlechallenge.org
Up to 365 days, deleted on sign-out
Strictly necessary
4.3. Browser local storage (localStorage)
Key
Purpose
Duration
bc-auth-storage
The access token and basic account data (identifier, name, e-mail address, profile picture, role), to keep you signed in
Until sign-out, when the values are cleared
bc_lang
The website’s language version, like the cookie of the same name
Until browser data is cleared
bc_invite_code
The invitation code from a link opened before an account was created
Until registration or use of the code
bc_location_granted, bc_location_denied
Your answer to the location question on the map, so that it is not asked again
Until browser data is cleared
bc_getapp_lang_handled
A note that the app download page has already chosen the language
The panel demonstration at bottlechallenge.org/demo-samorzad uses only sample data and also stores: bc-auth-demo (localStorage, a sample demonstration account), bc_demo_state (sessionStorage, the state of the demonstration until the tab is closed) and bc_demo_leads_v1 (localStorage, a contact request that could not be sent; deleted once it is sent).
4.6. Google Analytics, only after consent
Name
Provider
Purpose
Duration
_ga
Google
A random browser identifier that tells visits apart
2 years
_ga_ followed by the property identifier
Google
Session state in Google Analytics 4
2 years
5. Outside services on the website
Cloudflare carries the traffic to bottlechallenge.org and protects it against attacks. In doing so it may store its own technical cookies that tell people apart from automated programs. When an account is created, the website shows the Cloudflare Turnstile check.
Google and Apple. The sign-up and sign-in pages load the Google and Apple sign-in scripts. These companies then receive the IP address and may store their own cookies on their own domains under their own policies.
Maps. The map on the website loads tiles from Esri’s servers and fonts from OpenMapTiles, and the maps in the municipality and team panels load tiles from OpenStreetMap. These services store no cookies for the Foundation, but every request passes them the IP address and the area viewed.
Search and position. The place search and the address look-up for a place being added send the typed text or the coordinates directly from the browser to the OpenStreetMap Nominatim service. The map and the list of places ask get.geojs.io, or ip-api.com if it is unavailable, for an approximate position based on the IP address.
Stripe. For a donation the website sends you to a Stripe payment page, where Stripe stores its own cookies. Stripe stores no cookies on bottlechallenge.org.
Google Fonts. The print windows for a partner certificate and a team invitation poster load a font from Google’s servers. All other pages use a font stored on the BottleChallenge server.
The website embeds no videos, social media buttons or advertising pixels.
6. The mobile app
The app stores the following information on your phone:
Where and what
Purpose
The system’s secure store: bc_access_token, bc_refresh_token
Keeping you signed in; deleted on sign-out
auth-store
Sign-in status, name, e-mail address, identifier and role of the account
consent-store
Your decision on analytics
places-store
Recently viewed and favourite places with water; kept after sign-out
An invitation code or team code to be used after sign-in
On Android, the app reads the install information from Google Play (install referrer) on first launch to recognise a team code if the app was installed from an invitation link.
The app uses Google Analytics for Firebase, which stores its own app instance identifier on the phone. The app sends analytics events only after you consent in the prompt shown after the first launch: screen views, sign-in (method), e-mail confirmation, a bottle filled being accepted (number of EcoDrops), creating a team (type) and joining a team (method). The app does not pass your account identifier or an advertising identifier to Google.
Expo, the service through which the app’s notifications and updates work, gives the installation a random identifier and receives it when the app checks for updates and registers for notifications.
7. Changing your decision
7.1. On the website
The button below deletes your stored choice. When the page reloads the banner appears again and you can choose differently. Withdrawing consent stops Google Analytics from the next page load.
The button does not delete _ga cookies that Google Analytics stored earlier. You can delete them in your browser settings, under the data stored for bottlechallenge.org.
You can change your analytics consent in the app under Profile, Notifications, the “Analytics” switch. Access to location, camera and notifications is changed in your phone’s system settings. You can delete the data stored by the app by clearing the app’s data in the phone settings or by uninstalling it.
8. Do Not Track and GPC signals
The website does not read Do Not Track or Global Privacy Control signals. Google Analytics starts only after consent in the banner. If you make no choice in the banner, or choose “Essential only”, the website uses only the cookies and keys described as strictly necessary.
9. Changes to this policy
When the list of cookies or keys changes, the Foundation updates this policy and the date at the top of the page. When a new tool that needs consent is added, the website shows the banner again and asks for your decision.
