2. Categories of tools used by FlyMatch
A. Strictly Necessary Technical Tools (Do not require consent)
These tools are essential for the proper functioning of the Site and to provide the services requested by the user (e.g., authentication and session management). Pursuant to Article 122 of the Italian Privacy Code and ePrivacy regulations, they do not require prior user consent. This category also includes FlyMatch's own audience measurement tools: as they are first-party, used only to produce aggregated statistics, never combined with other data and never linked to your account, under the cookie guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021 they are treated like technical tools.
flymatch_token(First-party LocalStorage)
Maintains the authentication status of registered users and stores the JWT token to access the profile and saved data (favorite airports and travelmates). Duration: Until manual logout or browser cache clearance.sb-*-auth-token(LocalStorage / Supabase)
Manages OAuth session tokens and authentication via Supabase (e.g., Google sign-in). Duration: Until session termination or logout.fm_prefs(First-party cookie)
Remembers the language and currency of the Site. On the first visit they are set from the browser language and the country of the connection (provided by our CDN, Cloudflare); the IP address is not stored. Duration: 12 months.fm_vid(First-party LocalStorage)
Random identifier of the browser, used only to count the visitors who are not signed in (aggregated statistics). It is never linked to your account and the IP address is not stored. Duration: 13 months, then a new identifier is created.fm_usage_sid(First-party SessionStorage)
Random identifier of the visit, used only to group the pages of one visit in aggregated statistics. Duration: until the browser tab is closed.
B. Third-Party Analytical and Statistical Cookies (Require consent)
The Site uses statistical analytics services to collect aggregated information regarding user interactions and portal usage (pages visited, time spent, traffic sources).
Google Analytics 4 (GA4) with Google Consent Mode v2
- Provider: Google Ireland Limited / Google LLC.
- Measurement ID:
G-2PE74NMC5W - Cookies issued:
_ga(duration: 2 years, distinguishes unique visitors) and_ga_2PE74NMC5W(duration: 2 years, maintains session state). - Purpose: Collection of aggregated statistical data on website usage, page views, route searches, and filter configurations.
Anonymization & Consent Mode v2: By default, analytics tracking operates in strict adherence to Google Consent Mode v2. When a user declines analytics cookies or navigates without accepting, no persistent analytics cookies are read or set on their device; only cookieless, anonymized statistical pings with masked IP addresses are transmitted to ensure strict privacy compliance.
C. Third-Party Advertising and Profiling Cookies (Require explicit consent)
The Site integrates advertising services that utilize profiling cookies for the management, delivery, and measurement of commercial advertisements.
Google AdSense
- Provider: Google Ireland Limited / Google LLC.
- Publisher ID:
ca-pub-1007723907151033 - Cookies issued:
__gads,__gpi(duration: 13 months, ad frequency capping and fraud prevention) andIDE/test_cookieon thedoubleclick.netdomain (duration: 1 year, ad personalization and delivery). - Purpose: Delivery of personalized or contextual advertisements and performance tracking.
D. Third-Party Services Without Direct Profiling Cookies
- Google Sign-In / Google OAuth: Used for quick authentication via Google accounts (accounts.google.com), managing Google's own technical security cookies during login.
- Maps (OpenStreetMap, OpenFreeMap): The map backgrounds are loaded from the OpenStreetMap Foundation's tile servers and from OpenFreeMap. As with any web request, these servers receive the user's IP address; they set no cookies.
3. Summary Table of Tools
The table below provides a detailed summary of all storage and tracking tools utilized across the Site:
| Category | Name / Key | Provider / Domain | Purpose | Duration | Consent Required |
|---|---|---|---|---|---|
| Technical (LocalStorage) | flymatch_token | FlyMatch (flymatch.app) | Maintains user login and profile state | Persistent (until logout or cache clear) | No (Exempt) |
| Technical (LocalStorage) | sb-*-auth-token | Supabase / FlyMatch | Session management and OAuth tokens | Persistent (until logout) | No (Exempt) |
| Technical (Cookie) | fm_prefs | FlyMatch (flymatch.app) | Remembers language and currency | 12 months | No (Exempt) |
| Technical (LocalStorage) | fm_map_projection | FlyMatch (flymatch.app) | Remembers the flat or globe map view | Persistent (until cache clear) | No (Exempt) |
| Technical (first-party statistics) | fm_vid | FlyMatch (flymatch.app) | Counts visitors not signed in (aggregated statistics) | 13 months | No (Exempt) |
| Technical (first-party statistics) | fm_usage_sid | FlyMatch (flymatch.app) | Groups the pages of one visit (aggregated statistics) | Until the tab is closed | No (Exempt) |
| Analytical | _ga | Google Analytics (.flymatch.app) | Unique visitor identifier for aggregated statistics | 2 years | Yes |
| Analytical | _ga_2PE74NMC5W | Google Analytics (.flymatch.app) | Maintenance of analytics session state | 2 years | Yes |
| Advertising / Profiling | __gads, __gpi | Google AdSense (.flymatch.app) | Ad frequency and attribution tracking | 13 months | Yes (Mandatory) |
| Advertising / Profiling | IDE | DoubleClick / Google (doubleclick.net) | Ad tracking and personalization | 1 year | Yes (Mandatory) |
4. Managing and Revoking Consent
Upon first visiting the Site, users are presented with a cookie banner allowing them to accept all cookies, reject non-essential cookies, or customize their preferences granularly.
Consent can be modified or revoked at any time through the preference management panel accessible via the dedicated link located in the footer of the Site, or by clicking the button below:
Want to change your current choice? Reopen the preference dialog to update or revoke your consent.
Disabling Cookies via Browser Settings
Users can also manage, block, or delete cookies directly through their browser settings. Links to guidance for major browsers are provided below:
To specifically opt out of Google advertising cookies, users can visit the Google Ads settings page at https://adssettings.google.com or use the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout.
5. User Rights and Contact Information
Users can exercise their rights under Articles 15 et seq. of the GDPR (access, rectification, erasure, restriction, objection to processing) by sending a communication to the contact email address:
For further information on personal data processing, please refer to the Site's Privacy Policy.