Cookie Policy
Last updated: August 2026
1. What Are Cookies
Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and understand how you use it. BearMenu uses a minimal set of cookies to work and, with your consent, to improve. This page describes everything we actually write to your device — if you find something that is not listed here, tell us and we will fix it.
2. Cookies We Use
Essential and functional cookies
These cookies are required for BearMenu to work and to remember your choices. They are not used for analytics or advertising and, under art. 4 (5) of Romanian Law no. 506/2004, do not require consent — some of them are set on your first visit, before the cookie banner appears.
| Cookie | Purpose | Duration |
|---|---|---|
| bearmenu.session-token | Keeps you signed in to your account | Session / 30 days |
| bearmenu.csrf-token | Protects against cross-site request forgery | Session |
| bearmenu_cookie_consent | Stores your cookie preference (localStorage) | 1 year |
| bm_last_location | Remembers the last city you opened, so we can take you straight back there | 1 year |
| NEXT_LOCALE | Remembers your language (Romanian or English); read by the server before the page is rendered | 1 year |
| bm_traffic_source | Marks arrivals from scanning a venue's QR code, for aggregate statistics | 30 minutes |
Theme and other display preferences are stored in your browser's localStorage, not as cookies, and are never sent to our servers. City and language are cookies, because the server has to read them before rendering the page — they are in the table above.
Analytics Cookies
We use two analytics tools: Google Analytics 4 and PostHog. They show us which pages are visited, which features are used, how long sessions last and where errors happen. We use this data solely to improve the app. In Google Analytics, IP addresses are collected anonymised, and advertising features and Google Signals are switched off.
Analytics cookies are only set after you accept via the cookie banner. You can withdraw consent at any time by clearing cookies and localStorage for bear.menu in your browser; the banner reappears on your next visit.
| Cookie | Purpose | Duration |
|---|---|---|
| _ga | Distinguishes unique users (Google Analytics) | 2 years |
| _ga_* | Maintains session state (Google Analytics) | 2 years |
| ph_phc_*_posthog | Identifies the device for product analytics and session recording (PostHog) | 1 year |
PostHog and session recording
PostHog is our product analytics tool. Until you accept, it runs without cookies and writes nothing to your device — it keeps data only in the memory of the current page, which is lost when you close the tab.
Once you accept, PostHog sets its own cookie and starts session recording (session replay): it reconstructs your navigation — pages, clicks, scrolling, mouse movement — so we can see where people get stuck. The contents of text inputs are masked before anything leaves the browser. We never start recording if you decline or have not answered the banner yet.
3. Your Choices
You have full control over analytics cookies:
- Decline via banner — click "Decline" in the cookie banner when you first visit. Analytics cookies will not be loaded.
- Reset your preference — clear your browser's cookies and localStorage for bear.menu and reload the page. The banner will reappear.
- Browser settings — you can block or delete all cookies via your browser settings. Note that blocking essential cookies may affect sign-in functionality.
- Google Analytics opt-out — install the Google Analytics Opt-out Browser Add-on to prevent Google Analytics from collecting data across all sites.
4. Third Parties
We do not show ads on BearMenu, we do not sell ad space, and we do not use social network tracking pixels. The third-party cookies we set are Google Analytics' and PostHog's, both only after you accept analytics. In Google Analytics we have disabled advertising features and Google Signals, so your data is not used for remarketing or advertising profiles.
Both providers are companies established outside Romania. PostHog traffic goes through a domain of ours (t.bear.menu) to the provider's European infrastructure, and Google Analytics collects through Google's European collection endpoint. To the extent data leaves the European Economic Area, the transfer relies on the Chapter V GDPR safeguards (standard contractual clauses and/or the EU–US Data Privacy Framework). You can ask us for a copy of those safeguards.
5. Changes to This Policy
We may update this Cookie Policy to reflect changes in the cookies we use. We will update the date at the top of this page when we do.
6. Contact
Questions about our use of cookies? Email us at [email protected].