Cookie Policy
Last updated 16 July 2026
This page lists every cookie this site sets — all of them, not a category summary. There are four, we set all four ourselves, and none of them is an advertising or third-party tracking cookie. If you would rather read the short version: nothing here follows you to another website, because nothing here can.
Every cookie we set
| Cookie | What it does | Category | Expires |
|---|---|---|---|
_muhveli_v2_session
|
Keeps you signed in and protects forms against cross-site request forgery. Set only once you sign in. | Necessary | When you close your browser |
remember_user_token
|
Keeps you signed in between visits. Set only if you tick “Remember me” when signing in. | Necessary | 2 weeks |
muhveli_consent
|
Remembers the choice you made in the cookie banner, so we stop asking. Also carries a random reference so we can show which choice was recorded, and when. | Necessary | 6 months |
muhveli_visitor
|
A random id, meaning nothing on its own, that lets us tell a returning reader from a new one. Set only if you accept statistics, and deleted the moment you withdraw. | Statistics | 6 months |
01 How we count visits without a cookie
If you decline statistics — or never answer at all — we still count your visit. We just do it without keeping anything about you, and without putting anything on your device.
Here is the whole mechanism. When a page loads, our server combines your IP address and browser version with a secret that is randomly generated each morning, and runs the result through a one-way hash. What gets stored is that hash. The IP address is never written down: it exists for the microsecond it takes to compute the hash and is then gone.
The secret is destroyed after two days. Once it is, the hashes it produced can no longer be traced back to any IP address. Yesterday's visitor and today's visitor are unlinkable by construction, which is why counting you this way needs no permission: nothing is stored on your device, and what reaches our database is not information about a person.
02 What we do not do
- No Google Analytics, and no other third-party analytics. There is not a single third-party script on this page.
- No advertising or retargeting cookies, and no pixels from any ad network or social platform.
- No fingerprinting. We do not store your user agent, your screen size, your fonts, or anything else that would identify your browser among others.
- No selling, sharing or enriching. The data is never sent anywhere, because there is nowhere for it to be sent.
- No transfers outside the EU. Analytics data is written to the same database, on the same server in Finland, that runs the rest of Muhveli.
03 How long we keep it
Visit records are deleted after 14 months — long enough to compare one year against the last, and no longer. The daily secret behind the hashes is deleted after two days. Both are enforced by a job that runs every night, not by a promise to remember.
04 Changing your mind
You can change or withdraw your choice at any time, and doing so takes exactly as many clicks as granting it did. Use the “Cookie settings” link at the bottom of any page. If you withdraw statistics consent, the muhveli_visitor cookie is deleted immediately and no new one is issued.
05 Cookies in the Muhveli app itself
Once you sign in to a workspace, the app uses only the necessary cookies listed above. There is no analytics inside the product — what you and your team do in there is your business, and we have not built the means to watch it.
06 One third-party script, and where it is
The sign-up form loads Cloudflare Turnstile, which tells a human apart from a bot signing up in bulk. It runs on that one page and nowhere else, sets no tracking cookie, and exists to protect the service from abuse — which makes it strictly necessary under the ePrivacy Directive, and therefore not something we ask permission for. It is not on this page, and it is not on any page you can reach without deciding to create an account.
Cookie settings
Choose individually