Cookie and local-storage policy. Effective 14 April 2026 · Last updated 24 July 2026.
This Cookie Policy explains how
Ananas GDS UG (haftungsbeschränkt)
uses cookies and similar technologies on the Ananas GDS platform (
app.ananas-gds.com
), the public website (
ananas-gds.com
), and the test environment (
testingarea.ananas-gds.com
) (together, the “
Platform
”). It complements our
Privacy Policy
and is issued in accordance with § 25 TDDDG, Article 5(3) of Directive 2002/58/EC (ePrivacy Directive), and Articles 6 and 7 GDPR.
Cookies are small text files placed on your device by the websites you visit. In this policy, the term also covers functionally equivalent technologies such as local storage and session storage, IndexedDB entries, pixels, SDKs, and device identifiers, and any other means of storing information on your terminal equipment or gaining access to information already stored, within the meaning of § 25 TDDDG.
Under § 25 TDDDG, storing information on your device or accessing information stored there generally requires your prior, informed consent , unless the storage or access is strictly necessary to provide a telemedia service that you have expressly requested.
Ananas GDS uses strictly necessary first-party cookies and local-storage entries and, on our public website only, privacy-friendly, self-hosted, cookieless analytics that runs solely with your consent (clause 2.2). We do not set marketing cookies, profiling or advertising identifiers, social-plugin embeds, or any third-party analytics service.
These are essential to deliver the Platform and keep it secure, set on the legal basis of § 25 para. 2 No. 2 TDDDG . Without them, core features such as signing in, staying signed in, and protecting your account would not work.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sessionid | HTTP cookie | Django session identifier — keeps you signed in between requests | Session / up to 14 days |
| csrftoken | HTTP cookie | Cross-Site Request Forgery protection for form and API submissions | 1 year |
| authToken | Local storage | DRF token used by the frontend to authenticate API calls | Until sign-out |
| userId / userRole | Local storage | Routes the signed-in user to the correct dashboard | Until sign-out |
| theme / skin / layout | Local storage | Remembers your selected UI theme, layout, and language | Until changed |
| lang / locale | Local storage | Remembers your preferred interface language | Until changed |
| ananas_consent_v2 | Local storage | Remembers that you have acted on the consent banner and which categories you allowed (necessary / preferences / statistics / marketing) | Until cleared |
| ananas_optout_v1 | Local storage | Only written if you switch “Anonymous measurement” off — records your objection so we can honour it on later visits | Until cleared |
On our public website (
ananas-gds.com
) we use
Matomo
, an open-source analytics tool that we
host ourselves
on our own infrastructure at
analytics.ananas-gds.com
. We do
not
use Google Analytics or any third-party analytics service, and this data is never sold or shared. Matomo helps us understand how many people visit, which pages they view, and which countries, devices, and
referring sources they come from, so we can improve the site.
Matomo runs in two clearly separated tiers . Both are cookieless and both honour the “Do Not Track” browser signal.
Tier 1 — anonymous measurement (no consent required). For every visitor we count the page view in a storage-less way: nothing whatsoever is written to, or read from, your device — no cookies, no local storage, no browser-feature or screen-size read-out, no device fingerprint. All that is processed is the information your browser transmits with the request in any case (the page address, the referring address, the browser identification string, and your IP address, which is shortened before storage ). From this we can see how many visits a page receives and roughly which country, device class and source they came from. It cannot identify you and cannot follow you across websites. Because no information is stored in or accessed on your terminal equipment, § 25 TDDDG does not apply to this tier; the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating, securing and improving this website). You can object at any time, with immediate effect, by switching “Anonymous measurement” off in our privacy preference centre (the Cookie settings link in the footer of every page).
Tier 2 — statistics (consent required). Everything that goes beyond a plain page count — grouping your page views into a single visit, scroll depth, time on page, and clicks on buttons and outbound links — is only activated if you switch on the Statistics category in our banner. This tier stores the entries listed below in your browser and additionally reads your screen size and browser capabilities. Legal basis: § 25 para. 1 TDDDG in conjunction with Art. 6(1)(a) GDPR (consent). You may decline, and you may withdraw at any time with no loss of functionality — on withdrawal the entries below are deleted from your browser immediately.
Entries written by the Statistics tier, and only after you consent to it:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| ananas_session_v1 | Local storage | A rotating visit identifier that groups your page views into a single visit (resets after 30 minutes idle) | ~30 minutes |
| ananas_metrics_v1 | Local storage | A short, capped buffer of anonymous interaction events (page views, scroll depth, button clicks) | Until cleared |
We do not use any marketing, advertising, cross-site tracking, or profiling technologies. If we introduce any non-essential technology in the future (for example, marketing pixels or A/B testing), we will: (1) obtain prior, specific, informed and freely given consent through a consent banner, in accordance with § 25 para. 1 TDDDG and Art. 7 GDPR; (2) make the “reject all” option as easy to select as “accept all”; (3) not treat continued use of the Platform or scrolling as consent; and (4) update this Cookie Policy before they are activated.
The Platform does not currently embed third-party cookies set by other domains on its own pages. This includes the absence of social-plugin embeds, advertising networks, third-party video players, and third-party font loaders on authenticated areas.
Certain third-party services we use in the background — such as our payment processor Stripe — may set cookies when you are redirected to their own pages or iframes (for example, a Stripe-hosted checkout or billing portal). Those cookies are governed by the respective provider’s own cookie policy ( Stripe cookie settings ). We have no control over cookies set by third parties on their own domains.
Every page of this website carries a Cookie settings link in the footer. It reopens the consent manager with your current choices, where you can switch any category on or off, or object to the anonymous measurement described in clause 2.2 entirely. Withdrawing is exactly as easy as giving consent, takes effect immediately, and nothing on the site stops working as a result. Dismissing the banner without choosing is never treated as consent — it is recorded as “necessary only”.
You can allow, block, or delete cookies via your browser settings (Chrome, Firefox, Edge, Safari, and Opera all provide cookie controls in their help centres).
If you block or delete the strictly necessary cookies listed in clause 2.1, the Platform will not function correctly : you will not be able to sign in, your session will not persist, and secure operations protected by CSRF will fail. This is inherent to the nature of an authenticated B2B SaaS platform.
To clear local-storage entries, use your browser’s developer tools (Application / Storage tab) or the “Clear browsing data” feature. Signing out of the Platform also removes the authentication token and related entries.
Our self-hosted website analytics (clause 2.2) is configured to respect the “Do Not Track” (DNT) signal : if your browser sends DNT, that analytics will not record your visit even where the consent banner has been accepted. We do not engage in any cross-site tracking or profiling. Beyond honouring DNT for analytics, the strictly necessary cookies in clause 2.1 remain required for the Platform to function.
To the extent cookies and similar technologies process personal data (such as a session identifier linked to your account), the processing is based on § 25 para. 2 No. 2 TDDDG in conjunction with Art. 6(1)(b) GDPR (contract) for strictly necessary cookies; Art. 6(1)(f) GDPR (legitimate interest in securing the Platform) for security-related cookies such as CSRF tokens; and § 25 para. 1 TDDDG in conjunction with Art. 6(1)(a) GDPR (consent) for our self-hosted website analytics described in clause 2.2 and for any other non-essential technologies introduced in the future.
You have the right to withdraw any consent at any time, with effect for the future. To exercise your data-subject rights (Art. 15–22 GDPR), contact privacy@ananas-gds.com . Full details, including the right to lodge a complaint with the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), are set out in our Privacy Policy .
We may update this Cookie Policy from time to time to reflect changes in the technologies we use or in applicable law. The current version is always available via the footer of the Platform. Where we introduce new non-essential technologies, we will notify users through a consent banner and update the table in clause 2 accordingly.
Full provider details are set out in our Imprint .
This Cookie Policy forms part of our Privacy Policy and is complemented by the Terms of Service , Data Processing Agreement and Imprint . Effective 14 April 2026 · Last updated 24 July 2026.
