Last updated: August 27, 2026
1. What are cookies?
Cookies are small text files that websites store on the user's device to remember preferences and maintain sessions. This application also uses similar technologies such as the browser's localStorage and IndexedDB.
2. Cookies and storage used by this application
My Mattress uses both technically necessary cookies (to keep you signed in and remember your preferences) and analytics cookies (Google Analytics 4, only after you accept). You can change your mind at any time from your account privacy page or by re-opening the consent banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
mattress_locale | First-party cookie | Save the language selected by the user between sessions. | 1 year |
mattress-theme-mode | First-party localStorage | Save the visual theme preference (light / dark / automatic). | No programmed expiry |
| Firebase Auth session | First-party IndexedDB | Maintain the user's authenticated session. Without this information, the user would have to sign in on every visit. Managed internally by the Firebase SDK; does not contain directly identifiable data beyond the session token. | Session / automatic renewal |
_ga | Third-party HTTP cookie (Google Analytics 4) | Distinguish unique users for anonymous usage statistics (page views, error events). Only set after the user accepts analytics in the consent banner. | 2 years |
_ga_<container-id> | Third-party HTTP cookie (Google Analytics 4) | Persistent state for the session (used together with _ga to compute visit metrics). Only set after the user accepts analytics. | 2 years |
mattress_was_authed | First-party localStorage | Remember whether the last known session was signed in, so the landing page shows the right button immediately instead of waiting for the real session state to be confirmed. Not the source of truth for authentication: it only updates when the Firebase Auth session (previous row) changes. | Cleared on sign-out; otherwise no programmed expiry |
3. Consent and your choices
Articles 5.3 of Directive 2002/58/EC (ePrivacy) and 6.1.a of the GDPR (Regulation EU 2016/679) require prior, informed, specific and unambiguous consent for any cookie that is not strictly necessary to provide the service.
On your first visit a banner is shown with three actions of equal weight:
- Accept — enables Google Analytics 4 and the analytics_storage, ad_storage, ad_user_data and ad_personalization consent signals.
- Reject — no analytics cookies are set; the SDK is never mounted.
- Configure — opens a panel where you can pick the categories you allow, the same way you did on the banner.
You can change your mind at any time from your account privacy page; the change takes effect on the next navigation. The system also re-prompts automatically 12 months after your last decision, or whenever this policy materially changes.
4. Withdrawing consent
Withdrawing consent is at least as easy as giving it. From your account privacy page you can disable analytics in one click. The change is recorded in our audit log and the analytics cookies are removed on the next page load.
5. International transfers (Google Analytics)
Google Analytics 4 is operated by Google Ireland Ltd. on behalf of Google LLC (United States). The data is transferred to the United States under the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023) and the Standard Contractual Clauses approved by the European Commission. You can read the details in our Privacy Policy.
No advertising or profiling cookies are set by this application. The third-party cookies listed above are used exclusively for anonymous usage statistics and error telemetry.