Cookie Policy
What we use and why
Cookies are small pieces of data your browser stores and sends back to our server when you use Beauty Danmark. Local storage and session storage are similar, but the data stays in your browser only and is not sent automatically with every request. Session storage is cleared when you close the browser tab.
We use these technologies to run the site securely, remember your choices (such as language and theme), and keep temporary progress when you fill in forms. If you accept statistics, we also record how the site is used — such as visit counts and clicks — with a first-party cookie, so we can improve the service and show businesses statistics for their own stores. Without your consent we do not set that cookie. We do not set advertising or third-party tracking cookies on our own behalf. Some map and payment providers accessed in your browser may use their own cookies; see Third-party services below.
Strictly necessary cookies
These cookies are required for secure sign-in, completing two-factor authentication, a booking you are making, the dashboard, and recording your cookie choice.
better-auth.session_token (and __Secure-better-auth.session_token)
- Type: Cookie (HTTP-only on the server; name may include
__Secure- when using HTTPS).
- Purpose: Keeps you signed in after you authenticate with Better Auth.
- Duration: Until you sign out or the session expires as configured by the service.
- Where it is used: Across authenticated areas of Beauty Danmark.
Better Auth may also set short-lived helper cookies during sign-in, for example when you sign in with Google or Facebook, or when you choose not to stay signed in.
better-auth.two_factor (and variants)
Possible names include: better-auth.two_factor, __Secure-better-auth.two_factor, better-auth-two_factor, and __Secure-better-auth-two_factor (Better Auth may vary the prefix and separator).
- Type: Cookie (HTTP-only where set by the authentication flow).
- Purpose: Holds a short-lived challenge while you complete two-factor authentication (2FA).
- Duration: Short-lived; only during the sign-in flow; cleared when verification finishes or you cancel.
- Where it is used: Sign-in and 2FA verification flows.
pending_auth_redirect
- Type: Cookie (HTTP-only).
- Purpose: Stores where you should go after login and optional “add favorite” intent while you complete 2FA.
- Duration: 10 minutes (600 seconds).
- Where it is used: After password sign-in when 2FA is required, until 2FA succeeds or the flow is cancelled.
cookie_consent
- Type: Cookie (HTTP-only).
- Purpose: Records your analytics-consent decision.
v1 means you accepted analytics; rejected-v1 means you declined it. Analytics is only recorded when you have accepted — declining or ignoring the banner keeps it off.
- Duration: 1 year.
- Where it is used: Site-wide; tied to the cookie consent notice. You can change or withdraw your choice at any time by reopening the banner from the cookie button and choosing Accept or Reject.
bd_booking_session
- Type: Cookie (HTTP-only).
- Purpose: Keeps track of a time you have reserved and your booking requests on this device before you sign in. Contains only a random ID.
- Duration: 60 days.
- Where it is used: Booking at a store.
bd_active_company:v1 and bd_dashboard_view:v2
- Type: Cookies (HTTP-only).
- Purpose: Remember which business and which view (for example customer or business) you chose in the dashboard.
- Duration: Until you close the browser.
- Where they are used: The dashboard, when you are signed in.
better-auth.admin_session
- Type: Cookie (HTTP-only).
- Purpose: For Beauty Danmark staff only: keeps the staff member's own session while they view the platform as a user to give support.
- Duration: As the sign-in session; deleted when the staff member returns to their own account.
- Where it is used: The support tool in the administration.
testdesign_access
- Type: Cookie (HTTP-only).
- Purpose: Only for our internal preview of new designs: remembers that the access code was entered.
- Duration: 30 days.
- Where it is used: The
/testdesign page.
Functional cookies
These cookies remember choices you make so the site works better for you. They are not strictly required for every page load or for baseline security, but some features depend on them.
preferred_language
- Type: Cookie (readable by scripts; not HTTP-only in the server action that sets it).
- Purpose: Remembers your language choice (
da or en) so pages load in the right locale.
- Duration: 1 year.
- Where it is used: Language switching and routing across Danish and English URLs.
user_location:v1 (and legacy user_location)
- Type: HTTP-only functional cookie (set and read server-side only).
- Purpose: Remembers map and search location (coordinates and related data) so we do not have to ask every time. The location may include a postal code derived from your coordinates via reverse geocoding (Mapbox — see the third-party services section).
- Duration: 24 hours. Older
user_location values are migrated to the versioned cookie and removed.
- Where it is used: Maps, search, and location-aware store browsing.
- Automatic postal code on your profile: If you are signed in as a private user and have not provided a postal code on your account, we save the derived postal code to your profile the first time you use the location service. The postal code is only used to show you relevant salons nearby, and you can always view, change, or delete it under account settings. See also our privacy policy.
bd_search_session
- Type: Cookie (HTTP-only).
- Purpose: Remembers your latest search on the front page, so it shows again when you reload the page without running the search again. Set only when you search, and contains only a random ID.
- Duration: 1 hour from your latest search.
- Where it is used: Search on the front page.
bd_welcome_dismissed and bd_verify_email_dismissed
- Type: Cookies.
- Purpose: Remember that you closed the welcome dialog or the reminder to verify your email, so they do not show again right away.
- Duration: 7 days.
- Where they are used: The dashboard.
Analytics cookies
We use a single first-party cookie for statistics on how the site is used (visits, clicks, impressions). It is set only if you accept statistics in the cookie banner, and deleted if you decline or later withdraw your consent. The data stays with us, is used to improve the service and for the statistics businesses see for their own stores, and is not shared with third parties.
bdk_vid
- Type: Cookie (HTTP-only).
- Purpose: A random visitor ID so we can count unique visits, page views, and actions (clicks on phone, booking, website, and social links, and search-result impressions). Each recorded visit holds the ID, the page or store, the time, the domain of the page you came from, your country, and your browser language. Visits are stored without your IP address and without a link to your account; if you are signed in, we only note whether the store is among your favourites. Your IP address is used only briefly to limit abuse and is deleted at most three days after your last visit.
- Duration: 13 months from when you accept.
- Retention: Recorded visits are deleted after 25 months.
- Where it is used: Site-wide, once you have accepted statistics.
Local storage
Data in local storage stays on your device until you or the site clears it. It is not sent to our servers automatically.
theme
- Type: Local storage (set by next-themes, default key
theme).
- Purpose: Remembers your interface theme choice (light, dark, or system).
- Duration: Until you clear site data or change the setting.
- Where it is used: Site-wide appearance (theme toggle).
bd-store-wizard-draft:<userId>:<companyId> (and legacy bd-store-wizard-draft-v2 / bd-store-wizard-draft-v1)
- Type: Local storage, one key per account and company (e.g.
bd-store-wizard-draft:17:42), plus a bd-store-wizard-deleted-at:<userId>:<companyId> key that records when you last deleted a draft.
- Purpose: Saves progress in the “new store” creation wizard so you can continue later.
- Duration: Drafts older than 7 days are discarded automatically; you can clear sooner by finishing or abandoning the flow.
- Where it is used: Dashboard store creation wizard.
store-visual-edit-draft-<storeId>
- Type: Local storage (one key per store, e.g.
store-visual-edit-draft-123).
- Purpose: Saves a draft of the visual store editor for that store.
- Duration: Drafts older than 7 days are discarded automatically.
- Where it is used: Store visual editor in the dashboard.
email_resend_cooldown
- Type: Local storage.
- Purpose: Stores the next allowed time for clicking “resend verification email” so the action is not abused.
- Duration: Until the cooldown expires or you clear site data.
- Where it is used: Email verification page.
bd-pending-publish-v1
- Type: Local storage.
- Purpose: Remembers a store waiting to be published while you add a payment card, so we can confirm the publication when you return.
- Duration: Until the store is published or you clear site data.
- Where it is used: Publishing stores in the dashboard.
api-control-view
- Type: Local storage.
- Purpose: For Beauty Danmark staff only: remembers the chosen view in an administration tool.
- Duration: Until you clear site data.
- Where it is used: The administration.
Session storage
Session storage is cleared when you close the browser tab. It is not sent to our servers automatically.
partner-wizard-progress
- Type: Session storage.
- Purpose: Saves progress on the multi-step “Become partner” signup flow so you do not lose data when moving between steps.
- Duration: Until the tab is closed or you complete / clear the flow.
- Where it is used: Public become-partner wizard.
twoFactorBackupCodes
- Type: Session storage.
- Purpose: Holds your new two-factor backup codes until they are shown on the confirmation page; they are deleted as soon as they are shown.
- Duration: Until the codes are shown or the tab is closed.
- Where it is used: Setting up two-factor authentication.
Third-party services that may set cookies
When you use parts of Beauty Danmark that load content or complete payments in the browser, third parties may set or read their own cookies or similar storage. We do not control those cookies. Examples:
- Mapbox — map tiles may be loaded from
api.mapbox.com. When you use an address-search field, the text you type is sent to Mapbox (through our servers) to return address suggestions.
- Vercel Blob — images and assets may be served from Vercel’s blob storage host (browser connections only).
- QuickPay — payment flows may open QuickPay pages where QuickPay’s own cookies and policies apply.
Use each provider’s documentation and your browser settings if you want to limit third-party storage.
Managing cookies and site data
You can delete or block cookies and clear local storage / session storage through your browser settings. Features that depend on the items above may stop working: for example sign-in, language, map location, favourites before login, saved form drafts, theme, and cooldown timers.
Each browser handles this differently. Look for “Cookies”, “Site data”, or “Storage” in your browser’s help or privacy settings.
If you have questions about how we use cookies and browser storage, contact us at info@beautydanmark.dk.
Last updated: October 2026