fremai Cookie Policy

title: fremai Cookie Policy author: fremverk date: 2026-08-13 version: “1.0” status: Published v1.0 lang: en #

Last updated: 2026-08-13

Effective Date: 2026-08-13 — Version: 1.0 (see the change log for the effective date of each amendment)

This Cookie Policy is a companion to the fremai Privacy Notice, which is the primary GDPR document; this policy provides the detail on cookies and browser storage. It is fremai-specific and covers the fremai.eu surfaces only.

1. Purpose #

The ePrivacy Directive (2002/58/EC, as amended) and its national implementations require clear disclosure of cookies and similar technologies and consent for any cookie that is not strictly necessary. This policy documents every cookie fremai sets, its purpose, its class under Art. 5(3), and its lifetime — so the absence of a cookie banner is a verifiable commitment, not an omission.

2. Our posture in one line #

fremai sets only strictly-necessary session cookies on its authenticated surfaces, uses privacy- friendly, cookieless analytics on its public pages, and sets no advertising or third-party tracking cookies anywhere. No consent banner is needed — not because the question is hidden, but because fremai does not set cookies that would require consent. If cookie usage ever changes in a way that would require consent, a proper consent flow will be implemented before any such cookie is set.

3. Surfaces covered #

All cookies fremai sets are first-party. No analytics provider, advertising network, or session-replay tool sets a cookie on any fremai surface.

4. Strictly-necessary cookies (authenticated console) #

These cookies are strictly necessary under ePrivacy Directive Art. 5(3) — “strictly necessary for the provision of an information society service explicitly requested by the user” — and do not require consent.

Without these cookies the console cannot tell whether you are signed in; there is no anonymous mode for the authenticated console. A CSRF-protection token may accompany the session cookie as a strictly- necessary companion where write actions require it.

5. Analytics — privacy-friendly and cookieless #

fremai’s public pages (www.fremai.eu) use Umami, a privacy-friendly, self-hosted analytics tool. Umami is configured cookieless: it sets no cookies, uses no persistent client identifier, and does not track individuals across sites or sessions. It records aggregate, non-identifying page-view metrics only. Because it sets no cookie and performs no cross-site tracking, it does not require consent under Art. 5(3). No Google Analytics, Plausible-hosted, Matomo-hosted, Amplitude, Mixpanel, or similar third-party analytics is loaded on any fremai surface.

6. Bunny CDN #

Public assets and the console UI at www.fremai.eu, app.fremai.eu, and status.fremai.eu are delivered via Bunny CDN at EU points of presence only. Bunny provides caching and TLS termination for these assets; it does not set tracking cookies. Bunny never sits in the api.fremai.eu/v1 inference path and never sees prompts or completions (see DPA §11).

7. Sign-in to your identity provider #

The console sign-in is brokered by fremai’s self-hosted Zitadel identity layer. When you sign in — whether with a native fremai account or via your organisation’s federated identity provider — your browser is redirected to the sign-in flow, which may set its own strictly-necessary session cookies on its domain as part of authentication. Where you federate your own corporate IdP (Entra, Okta, Google Workspace, etc.), that IdP sets cookies on its domain, governed by its privacy policy — not this policy. Your fremai_session cookie is issued by app.fremai.eu only after a valid assertion is returned.

8. Third-party cookies — none #

fremai embeds no third-party tracking cookies on any surface. Specifically: no advertising networks; no session-replay tools (Hotjar, FullStory, LogRocket); no third-party analytics cookies; no embedded social widgets or CDN-loaded fonts/scripts that set cookies. The only third parties in the browser path are Bunny CDN (asset delivery, no tracking cookie) and the cookieless Umami beacon.

9. Browser local storage #

The console may use localStorage to remember UI preferences you explicitly set (for example theme or table density). These entries are written only in response to your action, are never used for analytics, advertising, or cross-site tracking, and can be cleared at any time via your browser’s storage inspector.

10. Your rights and choices #

• Browser controls — every major browser lets you view, edit, and delete cookies per site. fremai uses no storage mechanism designed to evade cookie deletion (no ETag tracking, no fingerprinting).
• GDPR data-subject rights — see Privacy Notice §7. Cookie data is within scope to the extent it contains personal data linked to your account.
• Supervisory authority — Datatilsynet (Denmark), per the Privacy Notice.

11. Changes to this policy #

fremai may update this policy to reflect changes in cookies or browser storage. Any change that would introduce a cookie requiring consent will be accompanied by a proper consent flow implemented before that cookie is first set. Material changes are announced per Terms.

12. Contact #

Cookie and privacy questions: privacy@fremai.eu.

Change log #