1. Audit result
The site uses no advertising or analytics cookies. Unless Do Not Track or Global Privacy Control is enabled, minimal audience measurement activates Firebase App Check with reCAPTCHA Enterprise and its necessary security storage.
| Name / storage | Purpose | Provider | Duration | Necessary | Consent |
|---|---|---|---|---|---|
| _GRECAPTCHA | Risk analysis and protection of the public statistics write endpoint against abuse | Google reCAPTCHA Enterprise / Firebase App Check | According to the current Google reCAPTCHA configuration | Yes, for securing measurement | No; it is not used for advertising measurement |
| Firebase App Check token (IndexedDB) | Time-limited proof that a request originates from the registered web application | Google Firebase | 24 hours; the SDK may refresh it at approximately half of its validity | Yes, for securing measurement | No |
| Firebase Auth session (SessionStorage) | Administrator access to private statistics | Google Firebase | Until sign-out or the browser tab is closed | Yes, only for the private section | No; created only after administrator login |
| firebase-heartbeat-database / firebase-heartbeat-store (IndexedDB) | Technical diagnostics and SDK heartbeat metadata (date and SDK version / agent; no visitor identifier) | Google Firebase | At most 30 daily records before sending or rotation | Yes, for Firebase SDK operation | No |
| LocalStorage | Not used for measurement or login | Jiný Kontext | — | No | Not required |
2. External services
Events stored in Firestore and hosting operational logs are server-side records, not browser storage. Measurement and App Check remain disabled when Do Not Track or Global Privacy Control is enabled. Share buttons open the selected network only after a click; no social widget is loaded beforehand.
Giscus comments are disabled, so their script and storage are not loaded.
Cloudflare Turnstile and the submission form are disabled.
3. Future changes
Before adding personalisation or another optional service that stores browser data, this inventory and an appropriate consent mechanism must be updated.