Cookie Policy

Effective date: October 2, 2026 · Consent version 3

This policy explains how [LEGAL ENTITY NAME], at [WYOMING REGISTERED ADDRESS], uses browser storage. Analytics must not be activated in production until these details, the controller contact, and, if required, [EU REPRESENTATIVE NAME AND ADDRESS] are completed and reviewed by qualified US/EU privacy counsel.

Your choice

Analytics is off by default. “Accept analytics” and “Use essential only” are equally available. Essential-only use leaves every product feature available. You can change or withdraw your choice at any time with Cookie settings. A changed consent manifest invalidates the old choice and asks again before collection.

Cookies

  • coinslator_consent: essential, signed, HttpOnly, Secure, SameSite=Lax; remembers the decision and consent version for 12 months. A random analytics identifier exists in it only after acceptance.
  • coinslator_csrf: essential, signed, HttpOnly, Secure, SameSite=Lax; protects preference and event writes for up to one day.
  • support_csrf: essential, signed, HttpOnly, Secure, SameSite=Strict; protects Support submissions and priority votes for up to one day. Support is available with essential-only cookies and does not require analytics consent.

Account authentication and security cookies are described in the Privacy Policy. We use no third-party analytics, advertising cookies, or cross-site activity tracking.

Analytics data and purpose

With consent, we measure page opens, approximate visible/active/background time, focus and idle states, session boundaries, allowlisted feature names, and only these environment categories: device class (phone, tablet, desktop), operating-system family (for example Android or Windows), and browser family (for example Chrome or Safari). We also collect allowlisted error/request categories, software and schema versions, and random analytics/session/tab identifiers. The server adds acceptance time. These categories are not used for fingerprinting.

We do not record analytics IP addresses, names, email or account IDs, full URLs/referrers, query/hash values, search or filter values, coin/exchange values, keystrokes, mouse coordinates, form content, tokens, stack traces, free-form errors, device make/model, hardware architecture, operating-system or browser version, or the raw User-Agent. Operational web-server security logs are separate from analytics.

Retention, withdrawal and transfers

Raw analytics events are retained for 90 days and consent audit records for two years. On withdrawal, matching events are excluded from reports immediately and physically removed no later than 30 days. Data is hosted and processed in the United States; safeguards for EEA/UK transfers are described in the Privacy Policy.

Rights and contact

You may request access, deletion, correction, restriction, portability, or object where applicable, withdraw consent without affecting earlier lawful processing, and complain to a supervisory authority. Contact [email protected]. Coinslator does not sell or share personal data for behavioral advertising; Global Privacy Control does not change that practice.