Cookie policy

What we use

Cookies are small values stored by your browser. Similar technologies can store information or access device information without being a cookie. This policy covers the current SpindlMarket configuration, including security checks provided by Cloudflare.

We currently use account authentication, security technologies and a preference cookie saved when you request display settings. We do not load advertising pixels, behavioural advertising scripts, third-party analytics or embedded sponsor websites. Sponsor and advertisement links do not set a SpindlMarket tracking cookie.

Account authentication

better-auth.session_token identifies your signed-in session. Hosted HTTPS environments use the __Secure-better-auth.session_token name. It is a first-party, HTTP-only session cookie used to maintain account access and enforce permissions. The configured session lifetime is seven days, with renewal as you use the service; signing out invalidates the current session.

Authentication and security cookies are necessary for the account features you request. Blocking them prevents sign-in and protected features. We do not enable Better Auth's browser session-data or account-data cache, and Google and Apple sign-in are currently unavailable.

Display settings you request

spindl-preferences-v1 stores your chosen country, currency and measurement display settings for up to one year after you save them. It is a first-party, HTTP-only cookie. The country is a preference you choose, not a location obtained from GPS or automatic profiling. Signed-in users also save these settings to their account.

This storage remembers the display settings you explicitly request through Preferences. It is not used for marketing or cross-site tracking. Use Preferences to reset the display settings, or remove this cookie in your browser. Removing only the browser cookie does not erase saved account preferences; change those through your signed-in account.

Cloudflare security

Hosted SpindlMarket uses Cloudflare network protection and Turnstile bot checks. These checks process technical browser and device information to distinguish legitimate requests from abuse. They can use security storage in their challenge context. They are not used by SpindlMarket to build advertising profiles.

Depending on the deployed Cloudflare features, security cookies such as cf_clearance or __cf_bm may be set. They are not set by our local preview. Cloudflare documents __cf_bm as expiring after 30 minutes of inactivity. Challenge clearance expiry depends on the configured security settings. Their availability depends on the active Cloudflare challenge and bot-protection configuration, and we must review that configuration before launch. A Turnstile verification token itself is a short-lived security proof, not an advertising identifier.

Maps you request

OpenStreetMap previews load only when you select Show OpenStreetMap preview. The map provider then receives your browser connection information, including your IP address. Our server looks up and caches the business’s public locality; private verification addresses are not used. SpindlMarket does not use the map for advertising tracking.

Controlling storage and future changes

You can inspect and delete cookies in your browser and block site storage. Removing a session cookie signs you out of that browser; use Sign out or account security controls to invalidate a session on the server. Blocking requested preference storage can prevent settings being remembered. Browser controls cannot delete server records held about your account.

We do not currently offer optional advertising or analytics storage. We will update this policy, assess each technology and offer the appropriate consent choices before introducing storage or device access that requires consent. Necessary account and security processing does not become optional merely because a cookie is deleted. See the privacy notice for personal-data uses, providers and your rights.