Browser storage record
Cookie and storage notice
The first-party cookies and browser storage GolVolt uses, when they are written, and how to control them.
- Effective date
- 2026-09-01
- Version
- 2026.09
This inventory is updated whenever GolVolt changes the cookies or browser storage it uses; the version and effective date above identify the current text.
Who manages this storage
- Controller / service provider
- ITTEST Michał Lejman
- Address
- ul. Pomorska 90c lok. 15, 80-333 Gdańsk
- Country
- Polska
- Tax identification number (NIP)
- 5842674931
- Statistical number (REGON)
- 382939540
- General contact
- [email protected]
- Privacy contact
- [email protected]
- Hosting and backups
- Hosting and backup service providers; servers in the EU/EEA
- International transfers
- Some providers (email delivery, including sign-in codes, and sub-processors of the payment operator Stripe) process data outside the EEA, including in the USA, under the EU–US Data Privacy Framework adequacy decision or standard contractual clauses (art. 46 GDPR).
- Supervisory authority
- Prezes Urzędu Ochrony Danych Osobowych
1. What this covers
Cookies are small values a website stores in the browser and sends with later requests. Local and session storage remain in the browser until the stated event or deletion. EU terminal-equipment rules also apply to comparable browser storage.
GolVolt separates authentication/security storage needed for a feature you request from convenience preferences written only after an explicit choice. A bare first visit does not need a marketing or analytics cookie banner because the reviewed build sets neither advertising nor third-party analytics cookies.
2. Authentication and security storage
| Name | Purpose and trigger | Lifetime |
|---|---|---|
| wch_user | Signed account ID after successful magic-code login; required to keep the requested account signed in. Secure, HttpOnly and SameSite=Lax in production. | 180 days, refreshed on active app requests; removed on logout |
| wch_id | Signed legacy Predictor membership map, created when the user uses that identity feature. Secure, HttpOnly and SameSite=Lax in production. | 180 days, refreshed on active app requests; removed on logout |
| wch_cap_next | Short-lived signed continuation that keeps a private invite path out of the login URL. Secure, HttpOnly and SameSite=Lax in production. | 15 minutes or until successful hand-off |
| wch_admin | Restricted internal administrator authentication marker; never used for an ordinary visitor. | 12 hours |
| htmx:localStorageTest (localStorage) | Constant-value compatibility probe used by the vendored HTMX library during browser history navigation. It is removed immediately and never contains page or user data. If storage is blocked, history navigation re-fetches the page. | Immediate set/remove |
| wch_onboarding | Signed draft of the clubs and matches you pick in the first-run setup before signing in, carried through login so the choice is not lost. Secure, HttpOnly and SameSite=Lax in production. | 1 hour or until the setup is saved |
| wch_intent | Signed, short-lived note of the one action you started before signing in (a prediction, a follow, a room join), carried through the email-code login so it is finished once afterwards. It holds only match, club or room references, the score and the nickname you typed, and a random one-time value tying it to that login. Secure, HttpOnly and SameSite=Lax in production. | 30 minutes or until the login finishes it |
| wch_flash | Signed one-line confirmation of that action, shown once on the page you return to. Secure, HttpOnly and SameSite=Lax in production. | 2 minutes or until shown |
| /sw.js (service worker) | Registered only when you turn on push notifications, so the browser can show them. It caches nothing. | Until site data is removed; turning notifications off ends the push subscription |
3. Preferences written only after your choice
| Name | Choice remembered | Lifetime |
|---|---|---|
| wch_locale | Language explicitly chosen by a language URL, query or picker; Accept-Language/default detection alone does not write it. | 1 year |
| wch_tz | Timezone explicitly selected in the footer, including the browser zone captured when you choose Auto. | 1 year |
| wch_tz_auto | Marks that Auto timezone—not a pinned named zone—was explicitly chosen. | 1 year |
| wch_cur | Chosen currency display label. GolVolt does not convert the underlying amount. | 1 year |
| wch_country | Explicit broadcast-country choice used for TV listings. | 180 days |
| gv_home_filter | Explicit scores window, league, focus, status, board and Mine filters. | 180 days |
| golvolt.accumulator.v2 (localStorage) | Planner legs you deliberately add, kept only in this browser. Clear replaces the value with an empty v2 payload rather than removing the key. | Until site data is removed; empty payload after Clear |
| golvolt.accumulator.v1 (localStorage) | Legacy planner payload read only to migrate it to v2, then removed. | Until the next migration-capable load or site-data removal |
| wchComments-{match ID} (sessionStorage) | Whether you opened the match-comments panel during the current tab session. | Until the browser tab/session ends |
| wch_theme | Light, dark or system appearance you choose. | 1 year |
| golvolt.layers.v1, golvolt.team-layers.v1, golvolt.player-layers.v1 (localStorage) | Which data layers you switched on or off on match, team and player pages. | Until site data is removed |
| golvolt.kupon.bank.v1 (localStorage) | The stake unit you enter in the planner calculator; never sent to GolVolt. | Until you clear it or remove site data |
| gv-fav-teams, gv-fav-offered (localStorage) | Clubs you star on this device, and which of them you were already offered to add to your account. | Until you unstar them or remove site data |
| gv-fav-offer-shown, wch_pwa_tonight_dismissed (sessionStorage) | Whether the offer to move starred clubs to your account, or the app-install card you dismissed, was already shown in this tab. | Until the browser tab/session ends |
4. Analytics and advertising
The reviewed implementation uses no advertising cookies, no cross-site tracking pixels and no Google Analytics, Meta Pixel or equivalent third-party browser analytics. GolVolt's aggregate analytics is server-side and does not assign a browser analytics cookie. Its pseudonymous visitor hash rotates daily and journal rows are pruned after 30 days.
If advertising, third-party analytics or any non-requested storage is added, it must remain off until a compliant prior-choice mechanism and updated notice are in place. Refusing optional storage must be as easy as accepting it.
5. External media and third parties
An externally hosted logo, crest, flag, news/social image, avatar, thumbnail or OpenStreetMap map can make a direct browser request even though it is not a GolVolt cookie. The external host ordinarily receives the IP address, User-Agent, resource URL and any referrer the browser sends. GolVolt's edge/application host also writes general access and security logs when a browser requests GolVolt. YouTube is an external watch link, so no YouTube player request is made until you choose to navigate. A link you open to a news outlet, YouTube, X, Instagram or another provider takes you to that provider's terms and storage practices. GolVolt does not control them and does not claim that blocking GolVolt cookies also blocks those external requests.
Buying GolVolt Pro opens a checkout or customer portal page hosted by Stripe. That page sets Stripe's own cookies under Stripe's cookie and privacy terms; they are not GolVolt cookies.
6. Your controls
- Use GolVolt's language, timezone, currency, country and filter controls to replace the relevant preference; clear browser site data to remove all first-party cookies and local/session storage.
- Logout removes account and legacy membership credentials. Browser settings can block all storage, but login, private invite hand-off, saved preferences or back/forward restoration may then not work.
- Contact the privacy address if observed storage differs from this inventory. Include the browser, page and time, but never send a private invite, share or unsubscribe token.