Cookie Policy
Effective date: 2026-09-13
Last updated: 2026-09-12
1. Introduction
This Cookie Policy explains how Noveo Europ Ltd. (we, us, or our) uses cookies and similar technologies on Lulliby and its related website and services (the Service). It describes the technologies we use, why we use them, their duration, and how you can manage or withdraw your choices. This Cookie Policy supplements our Privacy Policy.
The Service uses first-party browser cookies for sign-in, session continuity, and security. It also uses browser session storage and Cache Storage for limited functional purposes. With your consent, we use Google Analytics and PostHog analytics, including heatmaps, to understand how visitors use the Service and improve its usability. Google and Stripe may use their own technologies on their domains when you are redirected to them for authentication, Google Drive authorisation, or payment checkout.
2. What cookies and similar technologies are
Cookies are small text files placed on your device when you visit a website. They may be session cookies, which expire when you close the browser, or persistent cookies, which remain until they expire or are deleted.
Similar technologies include local storage, session storage, browser Cache Storage, pixels, tags, and software-development-kit identifiers. In this policy, we refer to cookies and similar technologies together as technologies.
3. Legal basis
- Strictly necessary technologies are required to provide a feature you request, such as authentication, session security, or payment checkout. Where applicable law permits, we use these without optional consent because they are necessary to provide the Service or for our legitimate interests in operating it securely.
- Functional technologies support requested features, such as temporary conversion notifications and local cover-image caching. We request consent where applicable law requires it.
- Analytics technologies are non-essential. In the EEA and other locations where consent is required, we load Google Analytics only after you consent. The legal basis for the associated personal-data processing is consent. You may withdraw consent at any time without affecting prior lawful processing.
4. Categories we use
Strictly necessary
These technologies support authentication, security, session management, checkout initiation, and other features you request. Blocking them may prevent the Service from working.
Functional
These technologies support conversion notifications and cache cover images so that requested pages load reliably and efficiently.
Analytics and performance
With your consent, Google Analytics collects information about how visitors use the Service so that we can understand usage, diagnose performance issues, and improve the Service.
Advertising
We do not currently use advertising, remarketing, or cross-site behavioural advertising technologies. We will update this policy and request any required consent before introducing them.
5. Technologies we use
Strictly necessary first-party cookie
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
podcast_stage_session |
Lulliby / Noveo Europ Ltd. | Maintains the authenticated session and stores limited session information, including the user identifier, email address, and temporary OAuth security state | Signed, HttpOnly, Secure in production, SameSite=Lax | Up to 7 days or until sign-out |
Google access and refresh tokens are stored encrypted on our server-side systems and are not stored in browser cookies or browser storage.
Functional browser storage
| Name or key | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
conversion-ready:<conversion-id> |
Lulliby / Noveo Europ Ltd. | Displays a conversion-completion notice after navigation | Session Storage | Until read or the browser tab/session ends |
conversion-notified:<conversion-id> |
Lulliby / Noveo Europ Ltd. | Prevents duplicate conversion-completion notices | Session Storage | Until the browser tab/session ends |
lulliby-local-covers-v1 |
Lulliby / Noveo Europ Ltd. | Caches audiobook cover images requested through the Service | Browser Cache Storage | Content is treated as fresh for 7 days and may remain until refreshed, removed by the Service, or browser site data is cleared |
lulliby-local-cover-metadata-v1 |
Lulliby / Noveo Europ Ltd. | Records when cached cover images were stored | Browser Cache Storage | May remain until refreshed, removed by the Service, or browser site data is cleared |
Google Analytics
With your consent, we use Google Analytics 4 (Google Analytics), provided by Google Ireland Limited, to collect usage and performance information. This may include a pseudonymous browser identifier, pages viewed, referring URLs, timestamps, approximate location, browser and device information, and interactions with Service features.
| Name | Provider | Purpose | Type | Default duration |
|---|---|---|---|---|
_ga |
Google Analytics | Distinguishes browsers using a pseudonymous client identifier | First-party persistent cookie | Up to 2 years, subject to browser limits |
_ga_<container-id> |
Google Analytics | Persists session state | First-party persistent cookie | Up to 2 years, subject to browser limits |
The exact suffix in _ga_<container-id> depends on our Google Analytics
measurement identifier. We configure Google Analytics user-level and event data
retention for no longer than 14 months. Aggregated reports may remain available
without directly identifying an individual user.
We do not permit Google Analytics to load or set analytics cookies before the required consent has been given. We do not enable Google Signals, advertising personalisation, remarketing, or Google Ads linking unless we first update this policy and obtain any additional consent required by law.
For more information, see Google's GA4 cookie documentation, Privacy Policy, and cookie information.
6. Google, Stripe, and external redirects
When you sign in or authorise Google Drive access, your browser is temporarily redirected to a Google domain. Google may use its own cookies and security technologies on that domain to authenticate you and record your choices. We do not control cookies set by Google on Google's domains.
When you initiate a payment, your browser is redirected to Stripe Checkout. Stripe may use cookies and similar technologies on its domains for checkout, payment security, fraud prevention, and regulatory compliance. We do not receive full payment-card details and do not control cookies set by Stripe on Stripe's domains.
See Google's cookie information and Stripe's Cookie Policy.
7. First-party and third-party technologies
- First-party technologies are set or operated from the Lulliby domain.
- Third-party technologies are set or operated by another organisation or from another domain, such as Google Analytics, Google authentication, or Stripe Checkout. Those providers may process information under their own policies as well as under agreements with us where applicable.
8. How we use technology data
We use cookies and similar technologies to:
- authenticate users and maintain secure sessions;
- protect login and account operations;
- provide Google OAuth and Stripe Checkout flows requested by users;
- display conversion-completion notifications;
- cache requested cover images;
- understand Service usage and performance with consent; and
- detect errors, maintain security, and improve the Service.
We do not sell personal data collected through these technologies or share it for cross-context behavioural advertising.
9. Consent and cookie settings
On your first visit, and again when required, we provide a cookie banner that allows you to accept analytics technologies, reject non-essential technologies, or review your settings. Rejecting analytics does not prevent access to the core Service.
You can change or withdraw your analytics consent at any time using the Cookie settings control available through the Service. When you withdraw consent, we stop future Google Analytics collection and remove analytics cookies that we can control from the Lulliby domain.
We record the date and time of your choice, the categories selected, and the version of this Cookie Policy to demonstrate and respect your preferences. We do not use the consent record for advertising.
10. Consequences of disabling technologies
If you reject or remove analytics technologies, the core Service will continue to work. If you block or delete the strictly necessary session cookie, you may be unable to sign in, remain signed in, or complete protected account actions.
Clearing site data may remove conversion notices and cached cover images. The Service can retrieve cover images again when they remain available.
11. Browser controls and other tools
Most browsers allow you to inspect, block, or delete cookies and site data. Browser settings may also let you clear session storage, service workers, and Cache Storage. Blocking all cookies may affect Service functionality.
Using a browser control does not always communicate your choice to us. The Service's Cookie settings control is the preferred way to record or withdraw consent.
12. Storage and retention
Cookie and browser-storage lifetimes are described in the tables above. Data collected through these technologies is retained as described in our Privacy Policy and is deleted or anonymised in accordance with the applicable retention schedule.
Consent records are retained only for as long as reasonably necessary to demonstrate compliance with legal obligations and respect your current choice.
13. Changes to this Cookie Policy
We may update this policy when our technologies, providers, purposes, or legal requirements change. We will publish the updated policy with a revised "Last updated" date and provide additional notice where appropriate.
14. Your rights and contact details
Depending on applicable law, you may have rights concerning personal data collected through cookies and similar technologies, including access, rectification, deletion, restriction, objection, portability, withdrawal of consent, and the right to complain to a supervisory authority.
You may contact the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus at dataprotection.gov.cy.
To exercise a right, request the current technology list, or ask a privacy question, contact:
Email: lullibynet@gmail.com
Postal address: 1, Anastasiou Sioukri, Themis Court, 4th Floor, Flat 402, 3105
Limassol, Cyprus