Cookie policy for Bobilvei
This is a translation. The Norwegian version applies.
Last updated: 23 October 2026
Status as of October 2026: Bobilvei is under development and has not launched. This policy describes the website as it is today, and was last checked in a browser on 15 October 2026. We will update it before we start using anything new that stores or reads anything on your device. Where something is planned and not yet in use, this is stated expressly.
What are cookies?
Cookies (informasjonskapsler) are small text files that are stored on your device when you visit a website. They are used for various purposes, such as remembering your login, storing preferences and analysing traffic. The rules in ekomloven (the Norwegian Electronic Communications Act) § 3-15 apply to all storage on your device and all retrieval of information from it, not just to cookies. This policy therefore covers both.
Which cookies do we use?
Strictly necessary cookies
These are required for the website to work and do not require consent.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| sb-<project-ref>-auth-token (may be split into several numbered parts – .0, .1 and so on – if the content is large) | Authentication – login and session (contains access and refresh tokens) | Up to 400 days, or until you log out | Supabase |
| sb-<project-ref>-auth-token-code-verifier | Set when you create an account or ask for a login link, as part of logging in. Contains a random code, no information about you | Up to 400 days | Supabase |
| bobilvei.installBannerClosed (stored in the browser for this tab, not a cookie) | Remembers that you closed or used the app banner at the top of the page on mobile, so that it is not shown again until you close the tab. Contains only the number 1, no information about you, and is never sent to us | Until you close the tab | Bobilvei |
| __Host-bv_wizard (draft listing without a confirmed email) | Lets you continue with your draft listing before you have confirmed your email address. Contains a random key, no information about you. Cannot be read by scripts on the page, and is sent only encrypted to bobilvei.no | Until you confirm your email address (it is then removed from the browser), at most 7 days | Bobilvei |
| __Host-bv_link (link from an email) | Set when you open a link from us in an email (for example to confirm your email address, log in or create a new password), and shows that the button on the page was pressed on bobilvei.no and not on another website. Contains a random value, no information about you. Cannot be read by scripts on the page, and is sent only encrypted to bobilvei.no | Until you press the button (it is then removed), at most 1 hour | Bobilvei |
The login cookie is set with a default lifetime of up to 400 days (the maximum that modern browsers allow). The session is renewed continuously while you use the service, and the cookie is deleted when you log out.
Payment-related cookies (Stripe)
When you open the payment page for a request, Stripe's payment component (Stripe.js) is loaded, and Stripe then sets two cookies:
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| __stripe_mid | Fraud prevention – a device ID that helps Stripe detect unusual payment patterns | About 1 year | Stripe |
| __stripe_sid | Payment security – a session ID for fraud prevention during the payment session | About 30 minutes | Stripe |
These are set only when the payment page loads – not during ordinary browsing on Bobilvei. Our assessment is that they are strictly necessary to provide the payment service you yourself have asked for: fraud prevention is an integral part of secure card payment, and they therefore do not require consent under ekomloven § 3-15. The assessment is our own. We will look at it again if Stripe changes what the cookies are used for.
Analytics and statistics tools
We use Plausible Analytics to measure visitor statistics (page views, traffic sources, popular pages).
- Plausible sets no cookies, stores nothing on your device and does not retrieve anything stored there.
- This is what Plausible receives when you open a page: the page's address, which page you came from, browser type and screen size, and your IP address. The IP address is used to count visits and is not stored. Plausible creates an anonymous code that changes every day, so a visit cannot be followed from one day to the next.
- The data is stored in the EU.
- Our assessment is that this does not require consent under ekomloven § 3-15, because nothing is stored on or retrieved from your device. The assessment is our own. The processing is based on legitimate interests (GDPR Art. 6(1)(f)); see the privacy policy, section 3.
If we start using an analytics tool that stores something on your device, we will update this policy and ask for consent first.
Error monitoring
We use Sentry to capture technical errors and to measure how long the pages take. Sentry sets no cookies and stores nothing on your device. What Sentry receives is set out in the privacy policy, section 2.6. Sentry data is stored within the EU (Frankfurt) for at most 30 days.
Marketing cookies
We use no marketing or tracking cookies.
Maps (TomTom)
Maps and address search come from TomTom. When a page shows a map, or you search for an address, calls go directly from your browser to TomTom, which then receives your IP address and what you search for.
- TomTom sets no cookies on our site (checked 13 October 2026).
- The map stores map images in the browser's cache when you open it, so that it loads faster next time. The cache contains only map images, no information about you. Our assessment is that this is necessary to show the map you yourself open.
Your choices
Everything the website stores on your device is, in our assessment, strictly necessary for services you yourself ask for:
- the Supabase cookies for login (see the table above),
- Stripe's two fraud-prevention cookies, which are set only when you load the payment page,
- the map images in the browser's cache, when you open a map,
- that you have opened a link from us in an email, until you press the button on the page, at most 1 hour,
- that you have closed the app banner at the top of the page on mobile, until you close the tab.
That is why no consent banner is shown. Why we treat Stripe's cookies as strictly necessary is set out under «Payment-related cookies (Stripe)» above. You can delete cookies and the cache at any time in your browser settings. If you delete the login cookie, you will be logged out.
Plausible and Sentry cannot be switched off in the browser settings, because they store nothing on your device, and we currently offer no technical opt-out. Both are based on legitimate interests (GDPR Art. 6(1)(f)). You have the right to object to the processing under GDPR Article 21: write to personvern@bobilvei.no, and we will assess the matter in light of your situation.
Changes
We update this page before we start using a new cookie or new storage on your device. If your consent is needed, we ask first. The date of the last update is shown at the top.
Contact
The website is operated by David Vang AS (org. no. 937 809 263, Vallefaret 21, 0663 Oslo). If you have questions about the use of cookies, contact us at hei@bobilvei.no.