Cookie policy.
What cookies and similar technologies Just Arrived uses, why we use them, and how you control them.
Last updated 28 September 2026
Applies to: justarrived.io and www.justarrived.io, including the admin app (/admin) and the kiosk and reception-display screens served from this domain.
Controller: ReadyLive Technologies, Copenhagen, Denmark (CVR 35622594) — privacy@justarrived.io
This policy explains what cookies and similar technologies Just Arrived uses, why, and how you control them. It supplements our Privacy Policy and Data Processing Agreement.
1. What we mean by “cookies”
“Cookies” here covers small text files placed on your device by a website, and similar technologies that store or read information on your device: browser storage (localStorage and sessionStorage) and tags/pixels loaded from third parties. EU ePrivacy rules and North American privacy laws treat these the same way, so we do too.
Technologies are grouped into three categories:
- Strictly necessary — required for the site or app to work. No consent is needed; you can’t switch these off, but you can delete them.
- Functional / preferences — remember choices you make (layout, clock format, dismissed tips). They are set only as a result of something you did in the app and are not shared with anyone.
- Advertising and measurement — set by Google to measure whether our Google Ads bring sign-ups, and to improve our ads. Off by default in the EU/EEA, UK and Switzerland until you accept.
We do not use analytics cookies, social-media pixels, chat widgets or any other tracking.
2. Strictly necessary
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
miinto_entry_device | Cookie | Just Arrived | Keeps a paired kiosk or reception-display tablet linked to its office, so it goes straight to the kiosk screen after a restart. Only set on paired devices. | 10 years, refreshed each start |
miinto-entry:device | localStorage | Just Arrived | Backup copy of the pairing above. | Until unpaired |
miinto-entry:config:<office> | localStorage | Just Arrived | Cached office set-up so the kiosk can start without a connection. | Until unpaired |
miinto-entry:queued-checkins | localStorage | Just Arrived | Check-ins made while the kiosk is offline, held until they can be sent to the server. May contain visitor details entered on the kiosk. | Until synced |
justarrived.kiosk.reload:<office>, justarrived.display.reload:<office>, justarrived.screen-recovery | localStorage | Just Arrived | Lets an administrator remotely reload a screen, and lets a screen recover after an error. | Until cleared |
justarrived.stale-bundle-reload | sessionStorage | Just Arrived | Prevents a reload loop when a new version of the app is released. | Until tab closes |
sb-…-auth-token | localStorage | Supabase (our hosting/database provider, EU) | Keeps you signed in to the admin app. | Until you sign out |
ja.consent | localStorage | Just Arrived | Remembers your cookie choice and the version of this notice you saw. | 12 months (we ask again after that) |
ja.analytics.optout | localStorage | Just Arrived | If present, switches the Google Ads tag off entirely — set when you use “Do Not Sell or Share” or your browser sends a Global Privacy Control signal. | Until cleared |
3. Functional / preferences (admin app only)
These keys are stored in your browser’s localStorage and are only ever read by the Just Arrived app on your own device. They are not transmitted to us or anyone else.
| Name | Purpose | Lifetime |
|---|---|---|
miinto-entry.admin.office-id | The office you last selected | Until cleared |
ja_admin_tour_done | You have completed the guided tour | Until cleared |
ja.admin.dashboard.office-order | Order of offices on your dashboard | Until cleared |
ja:office:general:left, ja:office:general:right | Widget layout on the office page | Until cleared |
ja.clock | 12- or 24-hour clock | Until cleared |
ja.setupGuide.<integration> | Progress through an integration set-up guide | Until cleared |
ja.customSwatches.<scope> | Colours you saved in the designer | Until cleared |
ja.designer.*, ja:designer-ui-scale | Designer panel layout, rulers, zoom and similar | Until cleared |
ja-designer-override | Which version of the designer you opened (sessionStorage) | Until tab closes |
justarrived.kiosk.recentHosts | Recently selected hosts on a kiosk, to speed up check-in | Until cleared |
ja.sub.<organisation> | Records that a subscription purchase has already been reported once, so it is never counted twice | Until cleared |
4. Advertising and measurement (Google Ads)
We advertise on Google Search. To know whether those ads work, we use the Google Ads tag (Google Ireland Ltd for EEA/UK/CH users; Google LLC, USA, elsewhere).
What it does when you accept: Google sets cookies on justarrived.io (for example _gcl_au and _gcl_aw, roughly 90 days) that let it recognise that you arrived via one of our ads and later started a trial or bought a subscription. We also send Google a one-way hashed version of your email address at those two moments (“enhanced conversions”) so that it can match the conversion to the ad click more reliably. Google may also use this data to improve ad targeting across its network. Full details: policies.google.com/technologies/ads.
What it does if you decline, or before you choose: the tag runs in “consent denied” mode. It sets no cookies and stores nothing on your device. Google may receive a cookieless, non-identifying ping that a page was viewed, which it uses only for aggregate modelling. If your browser sends a Global Privacy Control (GPC) signal, or you use the “Do Not Sell or Share” link, the tag is not loaded at all.
Where it runs: the public website and the admin app on justarrived.io. It never runs on kiosk or reception-display screens, so visitors checking in at a reception are never tracked by Google.
The legal basis in the EU/EEA/UK is your consent (ePrivacy Directive art. 5(3) as implemented locally, and GDPR art. 6(1)(a)). You can withdraw it at any time — see section 7.
5. Other third parties that receive your IP address
These services set no cookies and store nothing on your device, but your browser contacts them directly, which discloses your IP address and basic browser information:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — delivers the typeface used on all pages. Google states it does not use these requests for profiling. We are working towards self-hosting the fonts to remove this transfer.
- flagcdn.com — delivers the small flag images shown next to language choices.
- Supabase (EU region, Frankfurt) — our application backend. It is a processor acting on our instructions, not an independent third party.
When you buy a subscription you are redirected to Stripe’s checkout pages. Any cookies there are set on Stripe’s own domain under Stripe’s cookie policy.
6. International transfers
Google may process data in the United States. For EEA/UK/Swiss users this relies on the EU–US Data Privacy Framework (Google LLC is certified) and, as a fallback, Standard Contractual Clauses. Supabase data stays in the EU.
7. Your choices
- Cookie banner — on your first visit from the EU/EEA, UK or Switzerland you are asked to accept or decline advertising cookies. Nothing non-essential is set until you choose.
- Cookie settings — the “Cookie settings” link in the footer of every page reopens the banner so you can change or withdraw your choice at any time. Withdrawal takes effect immediately; cookies already set by Google are deleted on your next page load where technically possible, and otherwise expire on their own.
- Do Not Sell or Share My Personal Information (US) — Google Ads cookies may count as a “sale” or “sharing” under Californian and similar US state laws. Use the “Do Not Sell or Share” link in the footer, or turn on Global Privacy Control in your browser; we honour both and switch the tag off. We do not knowingly sell or share personal information of anyone under 16.
- Browser controls — you can block or delete cookies and site data in your browser settings. Blocking strictly necessary storage will stop the admin app and kiosks from working.
- Google opt-outs — adssettings.google.com and tools.google.com/dlpage/gaoptout.
8. Retention
Cookies and storage entries live for the periods in the tables above. The consent record (ja.consent) is kept so we can prove what you agreed to, and we re-ask after 12 months or whenever this notice materially changes. Conversion data held by Google is subject to Google’s retention (typically up to 26 months for ads data).
9. Changes to this policy
We will update this page when we add or remove a cookie or service and change the “last updated” date. If a change introduces new non-essential cookies, the banner will ask for your consent again.
10. Contact
ReadyLive Technologies, Copenhagen, Denmark — privacy@justarrived.io.