Schaduwplan uses no tracking cookies.

Schaduwplan places no cookies on your device. We use no Google Analytics, no Meta Pixel, no ad networks and no social trackers. You do not have to dismiss a cookie banner.

For product analytics in the logged-in part of the app (after signing in at /app) we use PostHog (EU) in cookieless mode. PostHog keeps its own identifier in localStorage(not a cookie); details under "localStorage" below. For error monitoring we use Sentry (EU) — which places no cookies and no localStorage. On public pages PostHog starts cookieless and without a persistent identifier, so there is no local storage for analytics there either.

What we do do: functional local storage in your browser, so the viewer remembers your work between page transitions and sessions. We distinguish three storage mechanisms — sessionStorage, localStorage and IndexedDB. None of these is a cookie and none is shared with third parties. We also send none of it to our own servers.

Under Article 11.7a of the Dutch Telecommunications Act (the Dutch cookie law) all of this falls under "strictly necessary" storage for which no consent is required. For completeness and transparency we list every key used below.

• No third-party analytics cookies (Google Analytics, Plausible, Matomo, Cloudflare Web Analytics). We use PostHog in the logged-in part, but without cookies — localStorage only.
• No marketing or advertising cookies.
• No social-media pixels (Meta, LinkedIn, TikTok, X).
• No cross-site tracking cookies.
• No fingerprinting at browser or hardware level.
• No A/B testing or conversion-tracking tools with their own cookies.
• Sentry (error monitoring) uses no cookies and no localStorage in our configuration. Session replay is off; IP collection is off.

This is a deliberate choice. Many websites use these tools to understand behaviour. We consider that unnecessary for a tool that visualises open government data.

Below, per storage mechanism, which keys Schaduwplan uses, why, and how long they remain. Everything is first-party (only on schaduwplan.nl in your browser) and stays on your device — we have no access to this data unless you actively send it to us.

sessionStorage is automatically erased as soon as you close the browser tab. We use it for short handovers between pages:

• schaduwplan:pendingAddressId — the PDOK id of the address you chose on the landing page, so that /app can load it immediately without URL parameters.
• schaduwplan:pendingAddressFull — the full address object (street, postcode, RD coordinates) for the same handover, so the viewer does not have to make a second PDOK call.
• schaduwplan:mobile-gate-dismissed — remembers within one session that you dismissed the mobile notice, so you do not see it again on every route change.

localStorage remains until you erase it via the viewer or via your browser settings. We use it for things you want to find again between sessions:

• schaduwplan:recent-addresses— at most 6 recently used addresses (street, house number, postcode, town, RD/WGS84 coordinates, BAG id), so the address bar can show a "recent" list. You can clear this list via the address bar or by erasing your browser data for schaduwplan.nl.
• schaduwplan:account-waitlist— if you leave your email address via the "Sign in / accounts are coming" popover, we keep it locally. We do not send it to our server. Once real accounts go live, we explicitly ask you again whether you want to submit your email.
• schaduwplan:attestation:<sha256> + schaduwplan:attestation:_index— only if you upload a PDF or photo of a permit or building drawing under "Adjust source data" to support a manual height correction. The file itself is stored base64-encoded locally (at most 5 MB in total), together with a SHA-256 hash for reference. Erase individual attachments via the "Remove attachment" button in that form.
• ph_phc_*_posthog (PostHog key with a variable suffix) — only after signing in at /app. Contains a randomly generated distinct_id linked to your account id for product analytics. On public pages PostHog starts cookieless and without a persistent identifier, so outside /app this key is not in your localStorage. Erase it via your browser settings → privacy → clear site data for schaduwplan.nl, or by signing out.

IndexedDB is the structural database in your browser. We use one database, called schaduwplan, with one store:

• projects — all scenarios you explicitly save via Projects → Save. Contains the address, planned buildings, measurement points, the chosen moment in time and the 3DBAG version the project was made on. Any heights derived from a GeoTIFF upload are included as a measured value in the saved project — the raw GeoTIFF file itself we never keep ("extract-and-discard"). Delete a project via the Projects list in the viewer.

This data does not leave your device either. You can erase the whole database via your browser settings → privacy → clear site data for schaduwplan.nl.

The 3D viewer makes connections to external services to fetch data. These providers place no cookies in your browser via us:

• PDOK (Kadaster) — for address autocomplete and BAG building resolution. A government service, directly from your browser.
• 3DBAG API (TU Delft + 3DGI) — for 3D building models. We route these calls via our own Cloudflare Pages function at /api/bag3d/* (24-hour edge cache, because 3DBAG sends no CORS headers). Cloudflare logs standard hosting metadata such as IP and timestamp; no cookies.
• PDOK (AHN4) — for height data, directly from your browser.
• Ellipsis Drive (AHN5/AHN6) — for more recent height data, directly from your browser. The distribution partner appointed by AHN — see ahn.nl/dataroom.
• Cloudflare Pages — our hosting; serves HTML/CSS/JS and the 3DBAG cache from EU edges. Places no tracking cookies in our configuration.
• Fonts — Fraunces, Inter Tight and JetBrains Mono come directly from our build via @fontsource. No runtime request goes to Google Fonts or another CDN.
• Sentry (eu.sentry.io / Frankfurt) — for error monitoring. The Sentry client in your browser sends, on errors, a payload with stack trace, browser and runtime context. Places no cookies and no localStorage in our configuration. IP addresses are not sent (sendDefaultPii: false); session replay is off.
• PostHog (eu.posthog.com / Frankfurt) — for product analytics in the logged-in part of the app. On public pages cookieless and without a persistent identifier; no storage on schaduwplan.nl. After signing in at /app PostHog keeps a distinct_id token in localStorage (see above under localStorage), without cookies.

Stripe (payment processing) places its own cookies on the Stripe domain (not on schaduwplan.nl) and only on the Stripe checkout page; the Stripe cookie statement and privacy statement apply to those.

Because we have no optional cookies or trackers, there is nothing to refuse or configure. Do you still want to erase all of Schaduwplan's local storage? You can do so in several ways:

• Per item within the viewer: use the buttons for "Clear recent addresses" in the address bar, "Remove attachment" in the source-data form, and "Delete project" in the Projects list.
• All at once: go to your browser settings → Privacy → clear site data for schaduwplan.nl. That removes sessionStorage, localStorage and the IndexedDB in one go.
• Private window: open Schaduwplan in a private/incognito tab — your browser then keeps nothing after closing.

Questions about this cookie statement or your privacy at Schaduwplan? Email [email protected]. For the broader context, see the privacy statement.