Effective from 20 July 2026 · v3
1.1 Cookies are small files stored on your device; other browser local storage (e.g. localStorage) serves a similar function and we treat it the same way as cookies. We use them for operation, security, measurement, and personalisation. Some cookies are set directly by us, others by providers we use (Google, Stripe) - see the table in Art. 3 for details. 1.2 You give consent for the management of cookies through the consent banner; strictly necessary cookies do not require consent.
2.1 Strictly necessary cookies (login, security, completing payment, storing your consent choice, language) are always active and do not require consent under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications - without them the Platform, or part of it, will not function. 2.2 All other categories - analytics, marketing, and preference cookies, where not strictly necessary - are set only with your consent. 2.3 You can withdraw or change your consent at any time by reopening the consent banner (the "Cookie settings" link in the footer) or through your browser settings. If you restrict cookies, some features may not work. 2.4 We do not respond uniformly to browser Do-Not-Track signals; the consent you have given governs.
An overview of the cookies the Platform actually sets is shown in the table below. The "Category" column indicates whether a cookie is strictly necessary or requires your consent.
| Name | Provider | Purpose | Category | Lifetime |
|---|---|---|---|---|
| next-auth.session-token (or __Secure-next-auth.session-token over HTTPS) | creatorbox (NextAuth.js) | Signs you in and keeps you signed in | Strictly necessary | 30 days |
| next-auth.csrf-token | creatorbox (NextAuth.js) | Protects the sign-in form against CSRF attacks | Strictly necessary | browser session |
| next-auth.callback-url | creatorbox (NextAuth.js) | Returns you to the correct page after sign-in | Strictly necessary | browser session |
| cb_locale | creatorbox | Remembers your chosen interface language (cs/en) | Preference | 1 year |
| cb_cookie_consent (browser local storage, not a cookie) | creatorbox | Stores your choice in the cookie consent banner | Strictly necessary | until cleared in your browser |
| cb_ref | creatorbox | Attributes a registration to a partner (affiliate) link | Marketing | 90 days |
| _ga | Google LLC (Google Analytics, via Google Tag Manager) | Distinguishes visitors for traffic measurement | Analytics (consent-gated) | 2 years |
| _ga_<container ID> | Google LLC (Google Analytics) | Persists session state for Google Analytics 4 | Analytics (consent-gated) | 2 years |
| _gid | Google LLC (Google Analytics) | Short-term visitor distinction | Analytics (consent-gated) | 24 hours |
| _gcl_au | Google LLC (Google Ads) | Measures conversions from ad campaigns | Marketing (consent-gated) | 90 days |
| __stripe_mid | Stripe, Inc. | Fraud prevention at checkout (device identification) | Strictly necessary (payment) | 1 year |
| __stripe_sid | Stripe, Inc. | Fraud prevention at checkout (session identification) | Strictly necessary (payment) | 30 minutes |
4.1 We manage consent using Google Consent Mode (v2): Google's analytics and marketing tags follow your choice, and the related cookies are stored only after consent is granted (the default state on page load is "denied").
5.1 We may update this Cookie Policy; we will announce material changes on the Platform. Questions: hello@creatorbox.cz. For details on the processing of personal data, see the Privacy Policy (creatorbox.cz/gdpr).