1. What are cookies?
Cookies are small text files that are stored on your device when you visit a website. They usually contain a random identifier and allow the server to recognize an ongoing session or a user preference. Cookies can be temporary (session) or permanent (persistent).
Similar technologies are local storage and session storage (browser-internal storage) as well as IndexedDB; in this policy we treat these collectively as “cookies”.
2. Marketing website castloop.de
Our public marketing site at castloop.de sets no HTTP cookies — neither technically necessary nor tracking/marketing cookies. No external analytics services (no Google Analytics, no Facebook Pixel, no Matomo) are embedded. Only the entries named in section 5 are stored in your browser’s Local Storage; they do not leave your device.
3. Application app.castloop.de
In the application at app.castloop.de we set exclusively technically necessary cookies that are indispensable for providing our service. Pursuant to § 25 (2) no. 2 TDDDG, no consent is required for these.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
cl_rt |
Refresh token (HttpOnly, Secure, SameSite=Strict, only for the sign-in path) — session extension without re-entering the password | 7 days, renewed with every extension | Required |
__Host-cl_oauth_… |
Binds an ongoing sign-in or account connection via OAuth to your browser and protects it against third-party access (HttpOnly, Secure) | 15 minutes, deleted on return | Required |
NEXT_LOCALE |
The language of the application you have chosen | 1 year | Required (convenience) |
theme, cl_session_hint, cl_dashboard_seen, castloop.setupBarDismissed (local storage) |
Display (light/dark), hint whether a session exists, and whether you have already seen the dashboard and closed the setup bar | Persistent, until removed by the user | Required (convenience) |
castloop.sso.*, cl_logout_reason (session storage) |
Security values during a sign-in via Google, second-factor prompt when signing in via an external provider, campaign identifier across the sign-in redirect and the reason for a sign-out | Until the tab is closed | Required |
In addition, a short-lived CSP nonce value (Content Security Policy) is delivered via HTTP header with every page load. This is not a cookie, as it is not stored on the user's device.
4. Cookies set by SSO providers (only when logging in via Google / Microsoft / Apple)
If you decide to log in via an external identity provider,
you are briefly redirected to its login page. The
cookies set there reside exclusively in the domain
of the respective provider (google.com,
login.microsoftonline.com, appleid.apple.com)
and are subject to the respective privacy and cookie policy
of that provider:
- Google: session cookies of the Google sign-in — see policies.google.com/technologies/cookies.
- Microsoft: session cookies of
login.microsoftonline.com— see privacy.microsoft.com. - Apple: session cookies of
appleid.apple.com— see apple.com/legal/privacy.
CastLoop has no influence over these cookies and does not read them either. They are only set during the actual login redirect.
5. Consent & cookie banner
Pursuant to § 25 TDDDG, consent is required as soon as cookies or comparable storage access are used that are not strictly necessary (e.g. statistics, tracking, advertising). Technically necessary cookies (§ 25 (2) no. 2 TDDDG) run without consent.
At present castloop.de uses no optional service that requires consent, in particular no statistics. For this reason no consent banner appears on your first visit. As soon as we use an optional service, a consent banner with equivalent options (“Accept all” / “Only necessary”) and a per-category settings view asks for your decision beforehand; optional categories (currently planned: statistics) remain off until you actively consent.
With the link “Cookie settings” in the footer of the
homepage you can open the settings yourself at any time. There you
can make your selection and change or withdraw your consent with
effect for the future. Your selection is stored locally in your
browser (localStorage entry cl_consent — itself strictly
necessary, as it documents your decision; it is only created once you
save a selection).
In addition, castloop.de stores two convenience entries in your browser’s Local Storage that only record your own choice of language and are permitted without consent under § 25 (2) no. 2 TDDDG:
cl_lang— the language you have chosen. The entry is created when you choose a language in the language switcher or via the language hint, and redirects you to that language on a later visit to the German homepage. It remains until you delete it.cl_lang_hint— the note that you have closed the language hint so that it does not appear again. It remains until you delete it.
6. Controlling & deleting cookies
You can view and delete the cookies that have been set at any time via your browser settings. Disabling the required cookies, however, prevents the use of the application (app.castloop.de) — login and persistent sessions then no longer work. Deleting the refresh token cookie leads to being logged out; you can log in again at any time afterwards.