Cookie Policy
Last updated: February 21, 2026
This document is available in English only. Translations are not yet published; the English text is the version that applies.
You can change your cookie preferences at any time.
Introduction
This Cookie Policy explains how FilmHQ OÜ ("FilmHQ", "we", "us", or "our") uses cookies and similar tracking technologies on our websites and applications (collectively, the "Service").
This policy should be read together with our Privacy Policy, which provides detailed information about how we process personal data.
By using our Service, you acknowledge that you have read and understood this Cookie Policy. You can manage your cookie preferences at any time through our cookie consent tool or your browser settings.
1. What Are Cookies?
Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, provide a better user experience, and give website owners information about how their site is being used.
Types of Cookies by Duration
| Type | Description |
|---|---|
| Session Cookies | Temporary cookies that are deleted when you close your browser |
| Persistent Cookies | Cookies that remain on your device for a set period or until you delete them |
Types of Cookies by Origin
| Type | Description |
|---|---|
| First-Party Cookies | Set by FilmHQ directly |
| Third-Party Cookies | Set by external services we use (analytics, advertising, etc.) |
2. How We Use Cookies
We use cookies and similar technologies for the following purposes:
2.1 Strictly Necessary Cookies
These cookies are essential for the operation of our Service. They enable core functionality such as security, authentication, and accessibility. You cannot opt out of these cookies as the Service would not function properly without them.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
sb-{ref}-auth-token | Supabase | Authentication session token (Secure; SameSite=Lax; non-HttpOnly, read by the Service's own scripts in your browser) | 90 days |
sb-{ref}-auth-token-code-verifier | Supabase | PKCE code verifier for secure sign-in (Secure; SameSite=Lax; non-HttpOnly, read by the Service's own scripts in your browser) | 90 days |
__cf_bm | Cloudflare | Bot protection | 30 minutes |
cf_clearance | Cloudflare | Security verification | 1 year |
tenant_id | FilmHQ | Multi-tenant session context | Session |
preferred_language | FilmHQ | Language preference | 1 year |
filmhq_consent | FilmHQ | Stores your cookie consent preferences | 1 year |
mfa_trust_token | FilmHQ | Remembers trusted device for MFA bypass | 90 days |
_fhq_attr | FilmHQ | Ad attribution data (click IDs from Meta, TikTok, Google) for server-side conversion tracking | 90 days |
Legal Basis: These cookies are necessary for the performance of our contract with you and for our legitimate interest in providing a secure service. The attribution cookie (_fhq_attr) enables accurate advertising measurement for our business clients.
2.2 Functional Preferences (Not Cookies)
FilmHQ stores functional preferences using localStorage and database fields rather than cookies. This provides better performance and privacy.
| Preference | Storage Method | Purpose |
|---|---|---|
| Theme (light/dark) | localStorage | Remembers your display preference |
| Sidebar state | localStorage | Remembers UI layout preference |
| Recently viewed films | Database | Shows your viewing history (requires account) |
| Cinema preference | Database | Remembers preferred cinema location |
| Notification settings | Database | Stores notification preferences |
Note: These are NOT cookies. They are stored locally in your browser (localStorage) or in your account profile (database). Clearing your browser data or logging out will reset these preferences.
Legal Basis: Legitimate interests for improving user experience. No consent required as these are not transmitted to servers via cookies.
2.3 Analytics Cookies
FilmHQ primarily uses server-side analytics (via GA4 Measurement Protocol) which does not require client-side cookies. This approach sends analytics data directly from our servers.
Client-side analytics cookies (optional):
The cookies listed below are NOT currently active on FilmHQ portals. They would only be set if a portal operator enables Google Tag Manager AND you provide consent:
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes unique users | 2 years |
_ga_* | Google Analytics | Maintains session state | 2 years |
_gid | Google Analytics | Distinguishes users | 24 hours |
_gat | Google Analytics | Throttles request rate | 1 minute |
Legal Basis: Consent. Client-side analytics cookies are only set after you have given explicit consent.
2.4 Marketing and Advertising (Server-Side Tracking)
FilmHQ uses server-side conversion tracking rather than traditional browser-based advertising pixels. This approach provides better privacy, accuracy, and compliance.
How it works:
- When you arrive at a consumer portal from an advertising platform (Meta, TikTok, Google), the click identifier is captured in the
_fhq_attrcookie (listed above in Strictly Necessary) - When you perform key actions (viewing films, clicking showtimes), events are sent directly from FilmHQ servers to advertising platform APIs
- No third-party tracking pixels are loaded in your browser
- Data flows server-to-server, not through browser scripts
What this means for you:
- Fewer third-party cookies on your device
- Tracking works consistently regardless of ad blockers (for measurement purposes only)
- Your browser is not tracked across other websites
Third-party marketing cookies (optional):
The cookies listed below are NOT currently active on FilmHQ portals. They would only be set if a portal operator enables client-side tracking integrations (such as Google Tag Manager) AND you provide consent:
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
_fbp | Meta (Facebook) | Browser identification | 3 months |
_fbc | Meta (Facebook) | Click identifier | 3 months |
_ga / _gid | Google Analytics | User distinction | 2 years / 24 hours |
tt_webid | TikTok | User identification | 1 year |
Legal Basis: The first-party attribution cookie is set under legitimate interests. Any third-party marketing cookies would require your explicit consent. Server-side conversion data is only shared with advertising platforms when you have given marketing consent via the cookie consent banner.
2.5 Server-Side Data Sharing (Consent Required)
When you grant marketing consent, FilmHQ shares certain event data with advertising platforms via server-to-server APIs. This data sharing is governed by the filmhq_consent cookie's marketing category.
What is shared (only with your consent):
| Data | Recipient | Purpose |
|---|---|---|
| Page views, showtime clicks | Meta Conversions API | Ad campaign measurement |
| Page views, showtime clicks | TikTok Events API | Ad campaign measurement |
| Page views, showtime clicks | GA4 Measurement Protocol | Analytics and attribution |
Ad click IDs (from _fhq_attr) | Respective ad platform | Conversion attribution |
What is NOT shared: Your name, email address, or any account details. Only anonymized event data and click identifiers are transmitted.
Legal Basis: Consent. Data is only shared with third parties after you explicitly grant marketing consent.
2.6 Behavioral Profiling (Legitimate Interest)
FilmHQ processes your on-site activity (such as which films you view, showtimes you explore, and pages you visit) to personalize your experience. This may include:
- Recommending films based on your viewing history
- Sending relevant notifications or emails about films you showed interest in
- Tailoring content based on your preferences
This profiling is performed under legitimate interest and does not require separate consent. You can object to profiling at any time by contacting us.
Note: Any email or push notification communications require separate opt-in consent under the ePrivacy Directive, which is managed independently from cookie consent.
3. Third-Party Cookies and Integrations
Important: FilmHQ uses server-side tracking by default, which does not require third-party advertising cookies. The cookies described in this section may only be set if:
- The portal operator (tenant) explicitly enables client-side integrations (e.g., Google Tag Manager)
- You have given consent via the cookie consent banner
Currently, no FilmHQ portals have client-side tracking integrations enabled.
Our Service integrates with various third-party platforms that may set their own cookies. We do not control these cookies. Please refer to the respective privacy policies for more information:
3.1 Video Content (YouTube)
When you watch embedded YouTube videos on our Service, YouTube may set cookies on your device.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
VISITOR_INFO1_LIVE | YouTube | Estimates bandwidth | 6 months |
YSC | YouTube | Tracks video views | Session |
PREF | YouTube | Stores preferences | 8 months |
GPS | YouTube | Geolocation for mobile | 30 minutes |
YouTube Privacy Policy: https://policies.google.com/privacy
3.2 Social Media Embeds
If you interact with social media features (share buttons, embedded posts), those platforms may set cookies:
- Meta (Facebook/Instagram): Meta Cookie Policy
- TikTok: TikTok Cookie Policy
- LinkedIn: LinkedIn Cookie Policy
3.3 Payment Processing
If you make payments through our Service, our payment processors may set cookies:
- Stripe: Stripe Cookie Policy
4. Similar Technologies
In addition to cookies, we may use other similar technologies:
4.1 Local Storage
We use browser local storage to store:
- Authentication tokens
- User interface preferences
- Cached application data
Local storage data persists until explicitly cleared by you or by our application.
4.2 Pixel Tags (Web Beacons)
Small transparent images that help us:
- Track email opens and clicks
- Measure advertising effectiveness
- Understand user engagement
4.3 Device Fingerprinting
We may collect limited device information for:
- Fraud prevention
- Security purposes
- Session management
We do not use device fingerprinting for advertising purposes.
5. Managing Your Cookie Preferences
5.1 Cookie Consent Tool
When you first visit our Service, you will see a cookie consent banner that allows you to:
- Accept all cookies
- Reject non-essential cookies
- Customize your preferences by category
You can change your preferences at any time by:
- Clicking the "Cookie Settings" link in the footer of our website
- Visiting your account settings (for logged-in users)
5.2 Browser Settings
Most web browsers allow you to manage cookies through their settings. You can:
- Block all cookies
- Block only third-party cookies
- Delete cookies when you close your browser
- Be notified when a cookie is set
Browser-specific instructions:
- Chrome: Manage cookies in Chrome
- Firefox: Manage cookies in Firefox
- Safari: Manage cookies in Safari
- Edge: Manage cookies in Edge
Note: Blocking all cookies may affect the functionality of our Service.
5.3 Opt-Out of Interest-Based Advertising
You can opt out of interest-based advertising through:
- European Interactive Digital Advertising Alliance: youronlinechoices.eu
- Network Advertising Initiative: optout.networkadvertising.org
- Digital Advertising Alliance: optout.aboutads.info
- Google Ads Settings: adssettings.google.com
- Meta Ad Preferences: facebook.com/ads/preferences
5.4 Do Not Track (DNT)
Some browsers offer a "Do Not Track" feature that sends a signal to websites. Currently, there is no industry standard for how websites should respond to DNT signals. Our Service does not currently respond to DNT signals, but you can manage your preferences using the methods described above.
5.5 Global Privacy Control (GPC)
We honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we will treat it as a request to opt out of the sale or sharing of your personal information and will not set non-essential cookies.
6. Cookies on Mobile Applications
Our mobile applications may use similar technologies including:
- SDK identifiers for analytics and crash reporting
- Device identifiers for authentication and security
- Local storage for app preferences and cached data
You can manage mobile tracking through:
- Your device's privacy settings
- App-specific settings within FilmHQ
- Resetting your advertising identifier
7. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in:
- The cookies we use
- Applicable laws and regulations
- Our business practices
When we make material changes, we will:
- Update the "Current as of" date at the top of this policy
- Display a notice on our Service
- Request renewed consent where required
8. Contact Us
If you have questions about our use of cookies or this Cookie Policy, please contact us:
Email: privacy@filmhq.pro
Postal Address: FilmHQ OÜ Tööstuse 47B 10416 Tallinn Estonia
9. Cookie Categories Summary
| Category | Required | Can Be Disabled | Consent Required |
|---|---|---|---|
| Strictly Necessary | Yes | No | No |
| Analytics (if GTM enabled) | No | Yes | Yes |
| Marketing (if GTM enabled) | No | Yes | Yes |
Note: Functional preferences are stored in localStorage/database, not as cookies. Analytics and Marketing cookies are only set if a portal operator enables Google Tag Manager, which is currently not active on any FilmHQ portal.
This Cookie Policy was last updated on February 21, 2026.
Cookies in use
Cookie information is being updated.