Cookie Policy
The Hungarian text governs. This is a translation for convenience.
1. What cookies and local storage are
A cookie is a small text file your browser stores. Some are needed for the service to work, others keep settings you choose, and one – only with your consent – remembers for the referral programme which referrer brought you. We use no advertising or web-analytics cookies.
Some data is kept not in a cookie but in your browser's local storage (localStorage). The same rules apply to local storage as to cookies, so those entries are listed in this policy too.
2. What cookies and local storage this platform uses
The list below covers every cookie the platform's website and customer portal (carbonhost.hu) set and everything they write to your browser's local storage. All of them are set by our own website. The webmail and the database manager (phpMyAdmin) that can be opened from the portal, where available, run at separate addresses and use their own cookies; this list does not cover them.
Strictly necessary cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
__Secure-authjs.session-token (split into .0, .1 … when large) | keeps you signed in; holds, encrypted, the access, refresh and ID tokens issued by our central identity system (Keycloak), and your account identifier, e-mail address and roles | persistent cookie, 30 days: set when you sign in, or when you change your password in the portal, and expires 30 days after that; deleted when you sign out |
__Secure-authjs.callback-url | the address to return to after signing in or out | until you close the browser |
NEXT_LOCALE | remembers the display language; set when the language in use differs from your browser's language setting, or when you switch language | until you close the browser |
ch_org | the organisation selected in the portal | 30 days |
ch_withdrawal_receipt | downloading the acknowledgement of receipt (PDF) of your withdrawal statement right after you send it, in the public "Withdraw from contract here" function or in the portal; holds the reference number of your withdrawal statement and the code that authorises the download | 30 minutes |
Your sign-in may end before the cookie expires. If you did not tick "Keep me
signed in" when you signed in, or if you changed your password in the portal,
your sign-in ends no later than 10 hours after you signed in or changed your
password; if you ticked it and have not changed your password since, no later
than when the cookie expires. The __Secure-authjs.session-token cookie may
then remain in the browser until it expires, but no longer gives access.
Outside the portal's usual sign-in, the sign-in framework may set two further
cookies: __Host-authjs.csrf-token (until you close the browser) when its
sign-in endpoints are opened directly, and __Secure-authjs.pkce.code_verifier
(15 minutes) in the redirect-based fallback sign-in, which the portal's
interface does not offer.
These are needed to provide the service, so they do not require consent.
Settings you choose
| Cookie | Purpose | Lifetime |
|---|---|---|
ch-density | compact or comfortable interface; set only when you switch the view | 1 year |
This cookie, and the theme and ch-rail-collapsed settings kept in local
storage (see below), are placed only when you change the display, solely to
keep the display you chose, and are used for nothing else. Because they are
created at your explicit request, for the feature you asked for, we do not ask
for separate consent to them. You can delete them in your browser at any time;
the interface then shows its default appearance.
Staff use only
| Cookie | Purpose | Lifetime |
|---|---|---|
carbonhost-impersonate | entering a customer view for support | 1 hour |
carbonhost-impersonate-session | the logged session that goes with it | 1 hour |
These exist only in an administrator account, and every such session is logged. They are needed for the support function the staff member starts, so we do not ask for consent to them.
Referral programme
| Cookie | Purpose | Lifetime |
|---|---|---|
ch_ref | remembers the referral code for registration | 30 days |
This cookie is not strictly necessary, and scripts running in the browser can read it. It exists so that, if you register in this browser while the cookie lasts, we record on your account which referrer brought you. If the referral programme is switched on, the referrer may receive commission after your first successful payment.
It is therefore created only with your prior, explicit consent. If you arrive through a referral link we ask whether we may remember the referrer, and until you say yes we store nothing. Declining does not limit your use of the portal — the referral is simply not recorded. If you do not arrive through a referral link, the question does not come up.
Your browser's local storage (localStorage)
Your browser does not send these entries to our servers automatically, and they are not removed when you sign out; you can remove them at any time by clearing this site's data in your browser settings.
| Name | Purpose | When it is created | Lifetime |
|---|---|---|---|
theme | light, dark or system-following theme | when you choose a theme | until you delete it |
ch-rail-collapsed | whether the sidebar is collapsed or expanded | when you collapse or expand the sidebar | until you delete it |
ch-draft:order | identifiers of the plan, billing cycle and add-ons picked in an unfinished order; contains nothing you typed | shortly after the order page opens, then updated on every change | deleted when you send the order, but the order page may save it again while the order is being sent or after sending fails; in that case, or if you do not order, it stays in the browser; 7 days after it was last saved it is no longer offered, and it is deleted the next time the order page opens, after which that page saves a new draft |
We do not ask for consent to the ch-draft:order entry: it is created
automatically after the order page opens, so that after a reload or a closed
tab we can offer to restore the plan you picked. You can place an order without
it.
3. Third-party cookies
The platform uses no advertising or web-analytics service and embeds no tracking code.
The sign-in, registration, password reset, order, ticket, contact and withdrawal forms run the Turnstile check provided by Cloudflare, Inc.: it loads from Cloudflare's servers, reads technical characteristics of your browser to filter out bots, and in doing so your IP address and those characteristics may be transferred to the United States. We do not ask for consent to this, because the check is needed to secure the form you are submitting. The details are set out in section 4 of the Privacy Policy.
4. Managing cookies and local storage
You can withdraw your consent to the referral cookie at any time, as easily as you gave it: with the button at the bottom of the Cookie Policy page, linked as "Cookies" in the footer of the public pages. Withdrawal deletes the cookie in this browser immediately, so no referrer is recorded at a later registration. If you registered after giving consent, you can ask at kantor.attila@carbonhost.hu for the referrer recorded at registration to be erased. Section 2.10 of the Privacy Policy explains what remains in the event log. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can also view and delete stored cookies and local storage entries, or block them being stored, in your browser settings. Blocking strictly necessary cookies prevents sign-in and some portal features from working.
Cookies and local storage are used by Kántor Attila egyéni vállalkozó as controller; the Privacy Policy covers how personal data is processed.
Questions: kantor.attila@carbonhost.hu
In force from: 2026-09-16
If you allowed the referral cookie earlier, you can withdraw that here at any time. After withdrawing, no referral is recorded at a later registration.