Cookie Policy
Last updated: 2026-05-21 Version: 2.0
This Cookie Policy explains what cookies and similar technologies Swaps uses, why, and how you can control them. It complements the Privacy Policy, which describes how we process personal data more broadly.
1. What is a cookie?
A "cookie" is a small text file a website stores on your device. Cookies let websites remember your preferences and activity. Similar technologies (localStorage, sessionStorage, IndexedDB, pixel tags, SDKs in mobile apps) work the same way for the purposes of this policy. We use the word "cookie" to cover all of these.
2. Categories of cookies we use
We classify cookies into four categories. Only Strictly Necessary cookies are set without your consent — they are required for the Service to work. All other categories require your active consent under the cookie banner.
2.1 Strictly Necessary (always on)
Required for the Service to function. Without these, you cannot log in, transact, or use core features.
| Cookie / key | Purpose | Lifetime | Set by |
|---|---|---|---|
sb-access-token, sb-refresh-token | Supabase Auth session | 1 hour / 7 days | Supabase (1st party) |
cf_bm, __cf_bm | Cloudflare bot management | Session | Cloudflare |
cookie_consent_v1 | Stores your consent choice | 12 months | Swaps (1st party) |
locale (localStorage) | Your selected interface language | Until cleared | Swaps |
csrf_token | CSRF protection on forms | Session | Swaps |
2.2 Functional (consent-gated)
Remember your preferences and enable convenience features.
| Cookie / key | Purpose | Lifetime | Set by |
|---|---|---|---|
theme | Light/dark mode preference | 12 months | Swaps |
recent_routes (localStorage) | Recent corridors you viewed | Until cleared | Swaps |
risk_modal_seen_v1 | Suppress the first-deal risk modal after acknowledgement | 90 days | Swaps |
referral_code | Remember the referral code you arrived with | 30 days | Swaps |
2.3 Analytics (consent-gated)
Help us understand how users interact with the Service so we can improve it.
| Cookie / key | Purpose | Lifetime | Set by |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 — pseudonymised user/session tracking | 13 months | |
vercel_* | Vercel Analytics — pseudonymised page-view tracking | 12 months | Vercel |
sentry-* | Sentry — error attribution to session | Session | Sentry |
GA4 is configured with IP anonymisation and EU data-residency on the front-end collector. Analytics data is aggregated and not used to identify you individually.
2.4 Marketing (consent-gated)
Used to measure the effectiveness of marketing campaigns (such as Friend Rate referral attribution).
| Cookie / key | Purpose | Lifetime | Set by |
|---|---|---|---|
utm_* (localStorage) | Last-touch UTM attribution | 30 days | Swaps |
referrer_origin | Source-of-traffic attribution | 30 days | Swaps |
We do not run third-party advertising trackers (no Facebook Pixel, no Google Ads pixel, no LinkedIn Insight Tag). We do not engage in cross-context behavioural advertising. If this changes, this policy will be updated and consent re-requested.
3. How to manage your consent
On your first visit, the cookie banner asks you to:
- Accept all — enable Functional, Analytics, and Marketing.
- Reject all — only Strictly Necessary cookies are set.
- Customise — choose categories individually.
You can change your choice at any time via the footer link "Cookie settings". Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
If you delete cookies in your browser, your consent record is also deleted; on your next visit, the banner will appear again.
4. Browser controls
Most browsers let you block or delete cookies through settings. Doing so may prevent some Service features from working. Specifically, blocking Strictly Necessary cookies will prevent login, session continuity, and security features.
- Chrome: chrome://settings/cookies
- Firefox: about:preferences#privacy
- Safari: Settings → Privacy
- Edge: edge://settings/content/cookies
The "Do Not Track" browser signal is not currently honoured by Swaps because there is no industry-standard meaning. We honour the Global Privacy Control (GPC) signal for California residents, treating it as a "do not sell or share" opt-out.
5. Mobile apps and Telegram / ChatGPT mini apps
The Swaps iOS application uses SDK-equivalent identifiers (an app-instance ID for Sentry crash reporting and a pseudonymised analytics ID) rather than browser cookies. You can reset both via iOS Settings → Swaps → Reset Identifiers. The Telegram mini app and ChatGPT mini app run inside their host (Telegram, ChatGPT) and use minimal session storage; the host platform's own privacy controls apply in addition to this policy.
6. Children
The Service is not intended for users under 18. We do not knowingly set cookies for users we know to be under 18. See the Privacy Policy §11.
7. Changes
We update this Cookie Policy when we add, remove, or change cookies. When we do, we change the "Last updated" date, and for material changes we re-request consent on next visit.
Contact: legal@swaps.app