Effective Date: 2 November 2026 Version: 1.1 Document ID: COOKIES-DRONEFIELD-v1.1 Language: English (binding)
What changed in version 1.1
- The Policy now also covers the Reseller Portal (
dealer.dronefield.app) and the project sharing viewer (share.dronefield.app). They follow the same rules as the Portal: a session cookie and a CSRF cookie on the Reseller Portal; on the share viewer, a session cookie only after you enter a share password.- We now describe the Cloudflare security cookies (for example
__cf_bm) and Cloudflare Turnstile bot protection on registration/login forms. Both are strictly necessary security measures, not advertising or analytics.- We now describe the local storage used by the AI chat assistant widget (a conversation identifier and whether the chat window is open or closed) on the Portal, the Reseller Portal and the documentation site.
- Knowledge-base videos are YouTube videos embedded in privacy-enhanced mode (
youtube-nocookie.com). They load only after you click play; preview thumbnails come from Google's image servers.- We corrected earlier statements that said the Sites had no live-chat widget, no embedded YouTube player and no third-party cookies at all.
- Unchanged: we still set no analytics, advertising or social-media tracking cookies, and there is still no cookie-consent banner. Section 10 explains why.
This Cookie Policy explains how DroneSpot Kft. ("Provider", "we", "us") uses cookies and similar technologies on the following sites (collectively, the "Sites"):
This Cookie Policy supplements, and should be read together with, our Privacy Policy (document PRIVACY-DRONEFIELD-v1.1), which is the authoritative document for all data-protection questions. Where this Cookie Policy and the Privacy Policy describe the same matter, they are written to say the same thing in compatible language. In the event of any inconsistency, the Privacy Policy prevails on data-protection substance, while this Cookie Policy provides the operational detail about cookies.
Our commitment. We use cookies and similar technologies only where they are strictly necessary to run and secure the Sites, or where they implement a preference or feature you have asked for. We do not set advertising, analytics, social-media or cross-site tracking cookies. If you have ever wondered why the Portal does not show you a cookie-consent banner, the answer is that the cookies we set do not require one under EU ePrivacy law. Embedded videos are loaded only when you click play (see Section 8). We have written this Policy to make that fact verifiable rather than just stated.
Cookies. A cookie is a small text file that a website asks your browser to store on your device. When your browser sends a subsequent request to the same website, it includes the cookie value, allowing the website to recognise the same browser across requests. Cookies are not programs and cannot execute code on your device; they are simple identifiers, typically a random string or a short readable value.
First-party vs. third-party cookies. A first-party cookie is set by the website you are visiting (in our case, one of the dronefield.app Sites listed in Section 1). A third-party cookie is set by a different domain that the website you are visiting has embedded, for example an advertising network. We do not allow any advertising or tracking third-party cookies. The only third-party services on the Sites that may store cookies or similar data on your device are Cloudflare (security, on all Sites), Stripe (only on the checkout page) and YouTube (only after you click play on a video). Section 8 describes each of them.
Session vs. persistent cookies. A session cookie is automatically deleted when you close your browser. A persistent cookie remains on your device until it reaches its expiry date or until you delete it manually.
Similar technologies. In addition to cookies, websites can store small amounts of data on your device using technologies such as:
The Portal uses a small amount of local storage for non-sensitive UI preferences, and the AI chat assistant widget on the Portal, the Reseller Portal and the documentation site uses local storage for a conversation identifier and its open/closed state. Section 7 describes both. Our Sites do not use session storage, IndexedDB, Web SQL, fingerprinting scripts, ultrasonic beacons or any other tracking technology. The Cloudflare Turnstile security check is described in Sections 4 and 6.
The cookies we set serve only two purposes:
We do not use cookies for:
The Portal at my.dronefield.app sets the following cookies. All of them are first-party cookies set by the Portal itself. The Cloudflare security cookies described at the end of this Section are set by our CDN provider, Cloudflare, on our domains and on its own Turnstile widget.
Session cookie.
dronefield_session (or equivalent, set by the Laravel framework)Authentication token cookie.
CSRF token cookie.
XSRF-TOKEN (Laravel default)Remember-me cookie (only if you opt in).
Cookie-acceptance cookie (only relevant if and when a future consent banner is introduced).
If we ever add a cookie that requires consent, we will introduce a consent banner; when you make a choice on that banner, we will set a small cookie to remember your choice. We do not set such a cookie at the date of this Policy because we currently use no cookies that would require consent.
Reseller Portal. The Reseller Portal at dealer.dronefield.app follows the same rules as the Portal. It sets a session cookie and a CSRF token cookie (XSRF-TOKEN) with the same purpose, type, legal basis and expiry as described above for the Portal, plus the Cloudflare security cookies described below.
Project sharing viewer. The share viewer at share.dronefield.app shows projects that a DroneField user has chosen to share via a link. Viewing a share that is not password-protected sets no cookie of the viewer's own. If the share is password-protected, the viewer sets a session cookie only after you enter the correct password, so that you can keep viewing the share and download its files without re-entering the password on every page. This cookie is strictly necessary, first-party and deleted when you close the browser. The Cloudflare security cookies described below also apply.
Cloudflare security cookies (all Sites). All dronefield.app Sites are delivered through Cloudflare, Inc. (USA), our CDN, reverse-proxy and DDoS-protection provider, which acts as our processor.
__cf_bm (Cloudflare bot management) and the cookies or tokens used by Cloudflare Turnstile;The documentation site at doc.dronefield.app is publicly accessible and does not require login. It sets only one cookie of its own.
Theme cookie.
The documentation site does not set any other cookies of its own: no session cookie (because there is no login) and no CSRF token. In addition to the theme cookie, the following apply on the documentation site:
The documentation site sets no advertising, analytics or tracking cookies.
We do not set, run, or allow on the Sites any of the following:
About Cloudflare Turnstile. On the registration and login forms, Cloudflare Turnstile runs a short browser check to tell humans apart from bots. It is used only for that security purpose and not for advertising, analytics or building a profile of you.
If you inspect any of the Sites in your browser's developer tools, you can verify these statements: only the cookies and local-storage entries listed in this Policy are present. The exceptions are the checkout page, where Stripe's cookies are present, and a video you have chosen to play, after which YouTube's may be present. Section 8 describes both.
Portal UI preferences. The Portal stores a small amount of data in your browser's local storage to remember UI preferences that are not security-sensitive. These values stay on your device, are never transmitted to our servers, and are not used for any tracking purpose. They include, for example:
You can clear these values at any time by clearing your browser's site data for my.dronefield.app. Doing so resets the relevant preferences to their defaults the next time you load the page; it does not affect your Account, your data, or anything stored on our servers.
AI chat assistant widget. The Portal, the Reseller Portal and the documentation site include an AI chat assistant (named "Rozi" or "Chloe", depending on the Site). It is an AI system, not a human, and the widget tells you so. It is provided through our own Luna AI service, not by a third-party live-chat provider. The widget may store the following in your browser's local storage:
These entries are functional. They are created only when you use the widget and are not used for advertising, analytics or tracking. The messages you type into the chat are sent to and processed by our Luna AI service and by Anthropic, PBC, the language-model provider Luna uses. Please do not type personal or confidential data into the chat. The Privacy Policy describes how chat messages are processed. You can clear these entries at any time by clearing your browser's site data for the relevant Site; the assistant will then start a new conversation.
Documentation site. The documentation site does not use local storage other than the chat widget entries described above and what the documentation framework needs to remember your theme preference (which is implemented as a cookie, as described in Section 5).
We do not embed third-party scripts or iframes that set advertising or tracking cookies on the Sites. Specifically:
Cloudflare. All Sites are delivered through Cloudflare, Inc. (USA) as CDN, reverse proxy and DDoS protection. Cloudflare processes your IP address and request data on our behalf as our processor and sets the security cookies described in Section 4, including Cloudflare Turnstile on the registration and login forms. Cloudflare's cookies are strictly necessary and are not used for advertising. Transfers to Cloudflare in the USA are covered by the EU Standard Contractual Clauses in Cloudflare's data processing addendum, and Cloudflare is certified under the EU-US Data Privacy Framework (see the Privacy Policy).
YouTube videos (click-to-play). Knowledge-base videos are YouTube videos embedded via youtube-nocookie.com. The video player is loaded only after you click play. Before that, only a preview thumbnail is shown, which is loaded from Google's image servers (i.ytimg.com). Loading the thumbnail means your browser contacts Google's server, which receives your IP address, but the YouTube player is not loaded. Once you click play, Google/YouTube processes data as an independent controller under its own privacy policy (https://policies.google.com/privacy) and may store cookies or similar data on your device. If you do not want this, do not start the video.
Stripe and the checkout flow. When you complete a paid Order on the Portal, the payment form is served by Stripe. The Stripe payment iframe is loaded from js.stripe.com and may set its own cookies for the purpose of fraud detection (Stripe Radar). These cookies are subject to Stripe's privacy notice at https://stripe.com/privacy and are a necessary part of completing a payment under PCI-DSS rules. They are not set unless you actually proceed to the checkout step, and they are not set on the documentation site or on Portal pages outside the checkout flow. You can review the cookies that Stripe sets in your browser's developer tools when you are on the checkout page.
A short reference for each cookie and storage entry described above:
You can shorten any of the above lifetimes by clearing your browser's cookies and site data for the relevant domain at any time.
You can manage, refuse, or delete cookies in several ways. The right method depends on your browser and on how granular you want the control to be.
Through your browser's settings. Every modern browser lets you view, allow, refuse, or delete cookies on a per-site or global basis, and lets you control how the browser handles cookies in private/incognito windows. The specific menus differ by browser, but most call the relevant section something like "Privacy and security" or "Cookies and site data". Some short references (independent links, not affiliated with the Provider):
Logging out of the Portal. Logging out is the simplest way to invalidate your session and authentication-related cookies. The Portal Logout button is in the top-right user menu, and the Software has a "Log out" option in its settings. The same applies to the Reseller Portal.
Untick the "Remember me" checkbox. If you do not tick "Remember me" at login, no Remember-me cookie is set and your session ends when you close the browser.
Clearing site data. Most browsers let you clear all data for a specific site (cookies, local storage, cache) in a single action. This is a clean way to reset your Portal state, or to remove the AI chat assistant's conversation identifier, without affecting other sites.
Not playing videos. YouTube's player is loaded only if you click play on an embedded video. If you do not click play, YouTube's player is not loaded and sets no cookies.
Effect of blocking strictly necessary cookies. If you block the session cookie, the authentication token cookie or the CSRF token cookie on the Portal or the Reseller Portal, those Sites will not function correctly: you will not be able to stay logged in, and form submissions will be rejected for security reasons. If you block the Cloudflare security cookies or the Turnstile check, Cloudflare may be unable to confirm that you are not a bot, and you may not be able to access the Sites or complete registration or login. If you block the session cookie on the share viewer, you will not be able to open password-protected shares. We recommend leaving these cookies enabled.
Effect of blocking functional cookies and storage. If you block the Remember-me cookie or the theme cookie, you simply lose the corresponding preference. You can still use the Sites normally; you will just have to log in every time, or the documentation site will revert to the default light theme. If you block or clear the AI chat assistant's local storage, the assistant will not remember your previous conversation and will start a new one.
No cookie-consent banner today. We do not show a cookie-consent banner because the cookies and storage entries described in this Policy are either strictly necessary or set only through your active choice: the "Remember me" checkbox, using the chat assistant, or clicking play on a video. If we ever change that by introducing a cookie that requires consent, we will add a banner before activating the new cookie, and we will not load it until you have made an active choice.
The Sites and the cookies set on them are not directed at children. As described in Section 13 of the Privacy Policy, the minimum age to register an Account on the Portal is 18 (or 16 with parental consent), and the minimum age to use the public documentation site is 16, in line with the default age for valid GDPR consent in Hungary.
We may update this Cookie Policy from time to time, for example to add a new cookie, to change the duration of an existing one, or to reflect changes in browser technology and applicable law.
This Cookie Policy is co-ordinated with the Privacy Policy: where a change affects both documents, we update both together.
If you have a question or concern about cookies on the Sites, the simplest way to reach us is:
For data-protection questions that go beyond cookies, please use the same channel and follow Section 12 of the Privacy Policy for the formal data-subject request procedure.
End of Cookie Policy.
Effective Date: 2 November 2026 — Version 1.1 — DroneSpot Kft.
© 2026 DroneField. All rights reserved.