Cookies and local storage
Operator and purpose
PR il Caffe Matvei Kazantsev, Ustanička 205v, Beograd, PIB 114522335, MB 67643909, delivery@ilcaffe.pizza, +381 11 456 1290. Effective 23.09.2026. Cookies are browser records which may be sent to the site; localStorage persists after a page closes; sessionStorage principally lasts for a tab session. These records are not automatically anonymous. They support access, security, baskets/order display and chosen settings, not hidden marketing permission.
First-party records
| Record | Purpose | Browser duration |
|---|---|---|
ilcaffe_session | Authenticated access; HttpOnly and Secure over HTTPS | Up to 7 days, or 8 hours for some methods; earlier logout/revocation possible |
ilcaffe_quote_owner | Basket quote ownership; HttpOnly | Up to 30 days |
ilcaffe_locale | Language cookie | Up to 365 days |
ilcaffe.google-maps-choice.v1 | Google choice/version and choice/expiry times; no identity/address | Valid 180 days; expired record removed on next site check/visit |
ilcaffe.locale.v1, ilcaffe.website.theme.v1 | Language and theme | No separate automatic expiry; until changed/cleared |
ilcaffe.preview.cart.v3, earlier v1/v2; ilcaffe.account.cart.v1:* | Local basket drafts/copies | No general automatic expiry; until replaced/cleared |
ilcaffe.preview.delivery.v1, ilcaffe.closed-orders.v1:* | Order/status display | No general automatic expiry; until replaced/cleared |
ilcaffe.cart.writer.v1, ilcaffe-debt-seen:* | Tab sync identity and already-seen notices | Tab session, potentially restored by the browser |
__Host-ilcaffe_staff_preauth, __Host-ilcaffe_staff | Authorised staff access only | Preauth up to 5 minutes; staff grant up to approximately 30 minutes |
An asterisk denotes a variable key suffix, not a disclosed user ID. These are browser durations, not retention of every server record.
External services
Google Maps/Places/Embed use external servers and may use identifiers/cookies depending on the browser and Google account. Loading sends technical data; searches/routes send relevant addresses or points. This website version has no embedded Yandex Metrika, Google Analytics or separate advertising pixels; this does not mean maps have no identifiers. Infobip and Telegram Gateway code delivery is server-side, not evidence of their advertising cookie on the page. See Google privacy.
Choice and clearing
Google maps, suggestions and embedded routes remain off until you allow them in Cookies and maps. You can continue without Google and change the choice in the menu/account/document footer. It is valid in this browser for 180 days, with renewed choice if the notice version changes. If storage is unavailable, the choice applies only to the current page and a warning is shown.
Withdrawing after Google loaded reloads the page to unload it. The saved basket remains; unfinished fields may clear. Withdrawal does not delete information Google already received or its third-party cookies. Maps terms and Google privacy also apply to Google functions.
Without Google you can use the menu and pickup. A new delivery address requires verification; call the pizzeria if you prefer not to enable maps. An unverified address is not automatically eligible for delivery. Optional storage requires the applicable prior choice; browsing, sign-in or purchase acceptance does not replace it. Necessity depends on the actual function, not a technical label.
Use site controls for language/theme or browser settings to clear cookies/localStorage. Clearing can end sign-in or remove local drafts/settings, but does not erase submitted orders or the server account; see the privacy notice. Browser/device location permission is separate from sending a typed address to Google. Updating this text does not itself create consent.
Guest-form cookie
When the guest form is available, ilcaffe_contact_guest supplies a random identifier that binds the one-use anti-abuse challenge to this browser. It is a host-only ilcaffe.pizza cookie, HttpOnly, SameSite=Strict and Secure over HTTPS, restricted to /api/v1/contact-email. Its maximum lifetime is 24 hours. The server challenge is valid for 15 minutes; this does not extend the cookie or mean all correspondence is retained for 15 minutes. The cookie contains no name, email, message text or image and is not used for advertising. Clearing it requires reopening the form. No external bot-checking service is used for this protection. Message delivery and temporary images are explained in the privacy notice.
Website contact supplement: 03.10.2026. Other terms of this edition remain unchanged.