Cookie policy
Last updated: October 1, 2026
Everylot, operated by Elowin Labs LLC, sets one small cookie to remember your cookie choices, the session cookies that keep you signed in if you sign in, two Google Analytics cookies while Analytics is on, and no advertising cookies for anyone.
The cookie notice
On your first visit a small notice in the corner of the page explains what the site stores and lets you accept all of it, decline what is optional, or open the preferences and decide category by category. There are two categories:
Essential is always on. It covers the session cookies Clerk sets when you sign in (below), the record of your cookie choices itself, the light or dark theme you pick with the switch in the header (kept in your browser's local storage as everylot.theme, because you asked for it with that click), and abuse prevention: any short-lived cookie Cloudflare's bot check needs on sign-in or on a form, and a rate limit on forms keyed by a hashed address, kept briefly on the server. The site cannot work without these.
Analytics covers the two analytics services we use to learn which pages and features help (see the privacy policy). Plausible Analytics, hosted in the EU, counts page views and a few coarse events without cookies. Google Analytics 4 measures the same page views and events and sets the two cookies listed below. We run Google Analytics with Google signals and ad personalization turned off and do not use it for advertising. In the EEA, the United Kingdom and Switzerland it runs without cookies until you accept Analytics. Measurement is on until you decline it; turn Analytics off in the cookie preferences and neither service counts your visits, immediately and on every later visit, and the Google Analytics cookies are removed. Our own daily counters are not affected: they carry no visitor identifier at all.
Plausible sets no cookies; Google Analytics sets the two cookies marked Analytics below, only while Analytics is on.
_ga(Analytics, 2 years): Google Analytics: a random identifier that lets us tell a returning browser from a new one when counting visits._ga_MG7R2T04GN(Analytics, 2 years): Google Analytics: keeps the state of the current visit.
Your answer is stored as one small cookie, el_consent, plus a matching local-storage entry, el-consent, each holding only your on-or-off choice per category and the time you made it. Both last 180 days, after which the notice asks again. If you leave the notice unanswered it closes itself after about twenty seconds and records what is already running: Essential on and Analytics on. In the EEA, the United Kingdom and Switzerland, Google Analytics stays cookieless until you accept Analytics. Nothing new starts at that moment. "Your privacy choices" in the footer of every page reopens the preferences whenever you want to change your answer.
Signing up for the newsletter sets one more Essential cookie, el_nl, for 180 days. It holds no address: a one-way scrambled form of the address that succeeded, what answer you were given, and a count of how many different addresses have been entered from this browser. It exists so that entering the same address again gets the same answer without another confirmation email, and so that a browser working through address after address can be refused. It is HTTP-only, so nothing on the page can read it, and it is never used to recognise you anywhere else.
Cookies when you sign in
Sign-in is provided by Clerk. When you sign in it sets __session (your session token, refreshed as you use the site), __client_uat (when your session last changed, so pages know whether to check it), and __clerk_db_jwt on development builds only. They are first-party, HTTP-only where the browser allows, and expire when you sign out or after the session lifetime. Signing out removes them.
Local storage
Your browser may cache pages, images and stylesheets to make the site faster; that is ordinary HTTP caching under your browser's control and stores nothing about you.
Besides the theme (Essential, above) and the copy of your cookie choices, the site keeps the zip code and radius of your last search in local storage (everylot.from) so a listing page can say how far away the car is. It never leaves your device and clearing site data removes it.
The results map remembers which view you picked (Canvas, Map or Satellite) in session storage (everylot.mapview) until you close the tab, so the next visit starts on the Canvas view again. It holds nothing else.
Saving a car takes an account. If you tap a heart while signed out, the id of that one car waits in local storage (everylot.save-next) while you sign up, so it can be saved to your new account; closing the sign-up without an account removes it.
If you sign up for the newsletter, the newsletter page keeps a note in local storage (everylot.nl) that this browser already signed up, and a count of recent tries (everylot.nl.tries). Neither holds your address. They are what makes the page say you are already on the list instead of asking again, and what stops a burst of repeated tries. Both are strictly necessary for the form, never leave your device, and clearing site data removes them.
Your location, if you allow it. The crosshair in the search box, and the note that appears when your state is not covered yet, can ask your browser where you are. Your browser asks you first, and nothing happens unless you allow it. If you do, your coordinates are rounded to about a tenth of a mile and sent once to this site, inside the request rather than in a web address, to find the nearest zip code; they are not stored, not written to any log, not attached to you, and not shared with anyone. The zip we get back is kept in local storage (everylot.geo) for twelve hours so you are not asked again, together with a note that the question was asked or declined. Declining is remembered and we do not ask again. Clearing site data removes all of it, and your browser's site settings can withdraw the permission at any time.
If you save a car with the heart button while signed out, the listing's id is kept in your browser's local storage so the saved page can show it again. That list never leaves your device except when you open the saved page, where the ids are sent once to fetch the current cards and are not logged or stored, or when you later sign in, when it is merged into your account once. It is strictly necessary for a feature you chose to use, holds no identifier for you, and clearing site data removes it.