At a glance
- lobbero.com sets no cookies. No analytics, no advertising pixels, no session recording, no error tracking, no tag manager.
- Our fonts are served from our own domain, so loading this page sends your IP address to no one but us. It used to go to Google Fonts; that was changed in September 2026.
- The app at app.lobbero.com sets four cookies, and all four are strictly necessary: three keep you signed in and one protects the sign-in from cross-site request forgery.
- There is no consent banner because nothing we set requires consent — not because we decided to skip asking.
01 lobbero.com — this website
This website is static HTML. It has no accounts, no login, no session, and no third-party script of any kind. It therefore sets no cookies and reads none.
Two things that would normally put a third party in the page, and do not:
- Fonts. Every typeface is self-hosted from lobbero.com/fonts. A web font loaded from a font CDN hands that CDN the reader's IP address and referring page on every visit; ours does not exist.
- Analytics. There is none. We do not know how many people read this page, and we would rather not know than learn it by putting a tracker in front of you.
The one thing this site sends anywhere is the email address you type into the Stays waitlist, and only when you press the button. That goes to our own API and nowhere else; see the Privacy Policy.
02 The Lobbero app
app.lobbero.com is the product. Signing in sets the cookies below. They are strictly necessary: without them there is no way to stay signed in from one request to the next.
| Cookie | What it is for | Flags | Lifetime |
|---|---|---|---|
| access_token | Proves who you are on each request to the API | httpOnly · Secure · SameSite | 15 minutes |
| refresh_token | Gets a fresh access token without asking for your password again. It is rotated on every renewal, and if an already-used token is ever presented, every session on the account is ended | httpOnly · Secure · SameSite | Up to 30 days |
| csrf_token | Protects against cross-site request forgery. This is the one cookie the app's own script can read, because the protection works by echoing its value in a header that a site on another domain cannot produce | Secure · SameSite | Session |
| admin_elevation | Set only for Lobbero's own platform staff while they hold a time-limited, audited grant in the internal admin console. A customer never receives this cookie | httpOnly · Secure · SameSite | Short-lived; expires with the grant |
That is the complete list. There is no analytics cookie, no advertising cookie, no A/B-testing cookie and no third-party cookie in the app either.
One thing worth knowing about the payment step
Card details are entered in fields hosted by Stripe, our payment processor, and never reach Lobbero. Stripe sets its own cookies for fraud prevention within those fields, under its own privacy policy. That is the only third party that can set a cookie anywhere in Lobbero, and it happens only on the billing screen.
03 Why you are not asked to consent
Under the EU ePrivacy Directive (and the UK PECR), consent is required to store or read information on a device unless it is strictly necessary to provide the service the user has asked for. Authentication cookies are the textbook example of that exception.
Everything we set falls inside it, so a banner would be asking you for permission we do not need — and a banner is only honest when refusing it actually changes something. If we ever add a cookie that is not strictly necessary, we will ask first, the default will be off, and this policy will say so before the cookie appears.
04 Other browser storage
Cookies are not the only way a site can keep something in your browser, so for completeness:
- lobbero.com — nothing. No local storage, no session storage, no IndexedDB, no service worker.
- The app — small values in local storage to coordinate your session across open tabs (so signing out in one tab signs you out in the others) and to remember interface preferences. This stays in your browser; it is not sent to us or to anyone else, and clearing your site data removes it.
- Push notifications — if you turn them on, your browser registers a subscription with its own push service (Google, Apple or Mozilla, depending on your browser). The message body is encrypted so the push service cannot read it. Turning notifications off removes the subscription.
05 Controlling cookies
Every browser lets you view, block and delete cookies, per site or in general — look for "Cookies and site data" under privacy settings.
What blocking ours will do
Because all four are strictly necessary, blocking cookies for app.lobbero.com means you cannot sign in — you will be returned to the login screen on every request. Blocking cookies for lobbero.com changes nothing at all, because there is nothing to block.
Browser "Do Not Track" and Global Privacy Control signals: we have no tracking to disable, so there is nothing for these signals to switch off. We do not sell or share personal information in the sense those signals address.
06 Changes to this policy
If the set of cookies changes, this page changes with it and the "last updated" date at the top moves. A new cookie that is not strictly necessary will be asked about, not announced.
07 Contact
Questions about this policy, or about anything stored in your browser by Lobbero:
- Email — hello@lobbero.com
- Entity — Moxelle, Inc., a Delaware corporation
- Post — 651 North Broad Street, Suite 206, Middletown, DE 19709, United States
See also the Privacy Policy, the Security & Trust page and our Data Processing Agreement.