<p><strong>Bazeta</strong> (bazeta.com) — Cookie Policy. Version 1.0.</p> <p>This policy explains how Bazeta uses cookies and similar technologies (local storage, session storage, service-worker caches, push tokens and advertising identifiers in our apps) and how you can control them. It supplements our <a href="/legal/privacy" rel="noopener noreferrer">Privacy Policy</a>.</p> <h2 id="1-what-cookies-are">1. What cookies are</h2> <p>Cookies are small text files stored by your browser when you visit a website. They let the site remember you between pages and visits. Local storage works similarly but is only readable by the site that set it. Our mobile apps use equivalent device storage.</p> <h2 id="2-cookies-we-set-ourselves-first-party">2. Cookies we set ourselves (first-party)</h2> <table> <thead> <tr> <th>Name</th> <th>Purpose</th> <th>Type</th> <th>Duration</th> </tr> </thead> <tbody> <tr> <td><code>session</code></td> <td>Keeps you signed in; identifies your session on the server</td> <td>Strictly necessary</td> <td>30 days (or until logout)</td> </tr> <tr> <td><code>csrf</code></td> <td>Protects forms against cross-site request forgery</td> <td>Strictly necessary</td> <td>Session</td> </tr> <tr> <td><code>lang</code></td> <td>Remembers the interface language you chose</td> <td>Preference</td> <td>1 year</td> </tr> <tr> <td><code>country</code>, <code>city</code></td> <td>Remembers the country and city you selected for browsing</td> <td>Preference</td> <td>1 year</td> </tr> <tr> <td><code>theme</code></td> <td>Light or dark theme</td> <td>Preference</td> <td>1 year</td> </tr> <tr> <td><code>consent</code></td> <td>Stores your cookie choices so we do not ask again</td> <td>Strictly necessary</td> <td>12 months</td> </tr> <tr> <td><code>pow</code> / Turnstile token</td> <td>Human verification when posting, registering or messaging</td> <td>Strictly necessary</td> <td>Minutes</td> </tr> <tr> <td><code>rid</code></td> <td>Random request identifier used for rate limiting and abuse prevention</td> <td>Strictly necessary</td> <td>Session</td> </tr> </tbody> </table> <p>Local storage keys: <code>theme</code>, <code>recent_searches</code>, <code>recently_viewed</code>, <code>draft_listing</code> (your unsaved listing form), <code>dismissed_banners</code>. Service-worker cache: static assets and the offline shell of the app.</p> <p>Strictly necessary cookies and preferences cannot be switched off in our banner because the Service would not work without them; you can still delete them in your browser.</p> <h2 id="3-third-party-cookies-and-identifiers">3. Third-party cookies and identifiers</h2> <table> <thead> <tr> <th>Provider</th> <th>Purpose</th> <th>Category</th> <th>Control</th> </tr> </thead> <tbody> <tr> <td>Cloudflare (<code>__cf_bm</code>, <code>cf_clearance</code>, Turnstile)</td> <td>Bot protection, security, CDN</td> <td>Strictly necessary</td> <td>—</td> </tr> <tr> <td>Adsterra (web, non-subscribers only)</td> <td>Displaying and measuring advertising; may set cookies and read device information</td> <td>Advertising</td> <td>Consent banner / GPC / Pro subscription</td> </tr> <tr> <td>Google AdMob (mobile apps, non-subscribers only)</td> <td>Displaying advertising in apps using the device advertising identifier</td> <td>Advertising</td> <td>App consent dialog / device settings ("Limit ad tracking", "Reset advertising ID")</td> </tr> <tr> <td>Polar (checkout pages)</td> <td>Payment session, fraud prevention</td> <td>Strictly necessary on checkout pages</td> <td>—</td> </tr> <tr> <td>YouTube / Vimeo (embedded video on EXPO booths and articles)</td> <td>Video playback; loaded only after you press play (privacy-enhanced embed)</td> <td>Functional</td> <td>Do not press play</td> </tr> </tbody> </table> <p>We do not use Google Analytics or any cross-site tracking pixel. Traffic statistics are computed from our own server logs in aggregated form.</p> <h2 id="4-advertising-and-consent">4. Advertising and consent</h2> <p>If you are in California or another US state with a privacy law, the use of advertising cookies may be considered "sharing" of personal information. You can opt out through the banner, by enabling <strong>Global Privacy Control</strong> (GPC) in your browser — we treat a GPC signal as an opt-out — or by subscribing to Pro, which removes third-party advertising entirely.</p> <p>Subscribers to <strong>Pro</strong> or <strong>Business</strong> plans do not see third-party advertising on the website or in the apps, and no advertising cookies are set for them.</p> <h2 id="5-how-to-control-cookies">5. How to control cookies</h2> <ul> <li><strong>Our banner:</strong> choose "Accept all", "Only necessary" or customise. Reopen it from the footer link "Cookie settings".</li> <li><strong>Browser settings:</strong> every browser lets you block or delete cookies. Blocking strictly necessary cookies will prevent login and posting.</li> <li><strong>Mobile apps:</strong> in the app's Settings you can withdraw advertising consent; in iOS/Android system settings you can limit ad tracking or reset the advertising identifier.</li> <li><strong>Do Not Track / GPC:</strong> we honour the Global Privacy Control signal as an opt-out of advertising cookies. The older "Do Not Track" header has no agreed meaning and is not honoured separately.</li> </ul> <h2 id="6-push-notifications">6. Push notifications</h2> <p>Web push notifications require your explicit permission in the browser. The subscription (endpoint and keys) is stored on our servers until you disable notifications in Settings or in your browser. In the apps, a device token is stored while notifications are enabled.</p> <h2 id="7-changes">7. Changes</h2> <p>We may update this policy when we add or remove tools. The version at the top indicates the current version.</p> <h2 id="8-contact">8. Contact</h2> <p>Questions about cookies: [email protected].</p>