Cookies and storage
This overview lists every cookie and browser storage mechanism Crevly uses: purpose, triggering action, provider, duration, data recipient, necessity and legal basis. It supplements section 9 of the privacy notice with the full detail. Crevly uses strictly necessary cookies and storage mechanisms only. There are no analytics, advertising or personalisation services, no third-party cookies and no embedded third-party content. For that reason Crevly shows no consent dialog: a choice between "reject" or "customise" would have nothing to control, and a dialog without real content would be pure decoration. If Crevly introduces a service that requires consent in the future, this page will be updated first and a genuine choice will be put in place.
Effective from: 27 September 2026 · Version 1.0
Cookies
`crevly_session` — sign-in and session: keeps the signed-in state active.
- Triggering action: successful sign-in
- Set by: Crevly (API)
- Duration: session cookie, ends with the browser or after 12 hours
- Data recipient: Crevly servers only
- Necessity: strictly necessary
- Legal basis: section 25(2) no. 2 TDDDG
`crevly_csrf` — protects state-changing requests against cross-site request forgery.
- Triggering action: sign-in; also reissued as needed
- Set by: Crevly (API)
- Duration: session cookie, reissued each time it is set
- Data recipient: Crevly servers only
- Necessity: strictly necessary
- Legal basis: section 25(2) no. 2 TDDDG
`NEXT_LOCALE` — remembers the selected language (German/English).
- Triggering action: visiting a page in a language that differs from the browser's
preference, or switching language
- Set by: Crevly (web)
- Duration: session cookie, ends with the browser
- Data recipient: Crevly servers only
- Necessity: strictly necessary (an explicitly chosen language preference)
- Legal basis: section 25(2) no. 2 TDDDG
`crevly_session` is set with the `httpOnly` attribute and therefore cannot be read by JavaScript; it contains a sign-in token. `crevly_csrf` is deliberately not `httpOnly` so the application can read and resend it. Both are additionally delivered with `secure` and transmitted only over HTTPS. Signing out removes `crevly_session` and `crevly_csrf`, but not `NEXT_LOCALE` — the language preference is kept, as it carries no personal data.
Local storage (persistent browser storage)
`camsales.session` — displays the signed-in state: name, tenants and roles in the interface.
- Triggering action: sign-in
- Set by: Crevly (web)
- Duration: until sign-out or until browser storage is cleared
- Data recipient: local to the browser only; never sent to Crevly servers
- Necessity: strictly necessary
- Legal basis: section 25(2) no. 2 TDDDG
`camsales.activeTenantId` — remembers the most recently active workspace.
- Triggering action: sign-in, switching workspace
- Set by: Crevly (web)
- Duration: until sign-out
- Data recipient: local to the browser only
- Necessity: strictly necessary
- Legal basis: section 25(2) no. 2 TDDDG
`crevly.bookings.fullDay` — remembers the "full day" display preference in the booking calendar.
- Triggering action: toggling the calendar view
- Set by: Crevly (web)
- Duration: persistent, until cleared manually through browser settings
- Data recipient: local to the browser only
- Necessity: strictly necessary (a usage preference)
- Legal basis: section 25(2) no. 2 TDDDG
`camsales.session` contains personal data that stays local to the browser and is never transmitted to Crevly servers: email address, display name, username, the time of the last sign-in, and the display names of assigned creators. It does not contain a sign-in token. This data is needed to render the signed-in interface and is removed on sign-out.
Session storage (kept for the duration of the browser session)
`camsales.logoutRedirect` — controls the redirect immediately after signing out.
- Triggering action: signing out
- Set by: Crevly (web)
- Duration: removed immediately once evaluated
- Data recipient: local to the browser only
- Necessity: strictly necessary
- Legal basis: section 25(2) no. 2 TDDDG
What is not used
Crevly does not embed any of the following categories:
- Third-party analytics, reach measurement or advertising services
- Personalisation or recommendation technologies
- Third-party cookies or storage access
- Embedded content from other providers (for example maps, videos, fonts, social networks)
Every connection the browser makes while using Crevly goes exclusively to Crevly's own servers. Independent of this overview, that is also enforced technically: the site's Content Security Policy allows connections only to its own origin.
Own usage measurement without storage access
Crevly measures individual usage events (for example page views or steps in the sign-up flow) to understand whether the product actually helps in daily work. This measurement sets no cookies and stores nothing in the browser — it is therefore not part of the inventories above. A random identifier, carried only briefly in the address, links a page view to a possible later registration. Details and how to object are set out in section 9 of the privacy notice.
Control and objection
Because only strictly necessary mechanisms are used, there is no consent to withdraw. Browser settings let you delete or block cookies and local storage at any time; without the necessary cookies, however, signing in is not possible.
You may object to the usage measurement described in section 5 under Art. 21 GDPR (contact address: section 1 of the privacy notice); your account will then be excluded from the measurement.
Changes to this overview
If a new service that uses cookies, local storage or comparable mechanisms is introduced, this page will be updated before it is used. Where the new service requires consent, Crevly will additionally put in place a genuine choice with equivalent options to reject, customise and accept before the service becomes active.