Cookie policy

A cookie is a small text file a website asks your browser to store and send back on later requests. It is what lets a site recognise the same browser from one page to the next — without one, signing in would not survive a single click.

All of the following are strictly necessary: the platform cannot provide the service you asked for without them. None of them are used to profile you, build an advertising audience, or follow you to other websites.

• af_session — keeps you signed in. It holds a random token, not your identity: your details stay on our server and the token only points at them. It is set when you sign in and removed when you sign out, and it expires on its own after a period of inactivity. It is marked HttpOnly, so scripts running in the page cannot read it, SameSite=Lax, so it is not sent from other people’s websites, and Secure, so it is only ever transmitted over HTTPS.
• af_tiktok_oauth_state — a security cookie set only for our own administrators, and only during the few seconds it takes to connect our TikTok integration. It carries a random value used to verify that the response coming back from TikTok belongs to the request we sent, which is what stops a third party forging that step. It lasts ten minutes and is never set for clients or visitors.

The public pages of this website — everything you can read without signing in — load Google Analytics, so that we can see which pages people find useful and where they arrive from. It sets two cookies:

• _ga — distinguishes one browser from another so repeat visits are not counted as new people. It lasts two years.
• _ga_X9PJQKSL5T — holds the state of the current visit for our specific property. It also lasts two years.

Neither is used for advertising and neither carries your name or email. Google receives the address of the page you are reading, roughly where in the world you are, and what kind of device and browser you use.

It does not run once you sign in. The tag is loaded only on the public website, never on the client dashboard, the administration console, or the sign-in, registration and password pages. What you do inside your own account — the accounts you hold, what you spend, what you request — is never sent to Google.

You can refuse it. Browser settings will block third-party scripts, and Google publishes an opt-out add-on that stops Analytics on every site at once. Blocking it changes nothing about how this site works for you, and the signed-in platform is unaffected either way.

We do not use advertising cookies, retargeting pixels or social media tracking cookies, and nothing here follows you to other websites or builds an advertising profile of you. Apart from Google Analytics on the public pages, no third-party scripts run on this site.

Separately from cookies, we store one value in your browser’s local storage: afads.cookie-notice, recording that you closed the cookie notice so it does not reappear on every page. It never leaves your browser and is not sent to us. Clearing your browsing data removes it, and the notice will simply appear once more.

Every browser lets you view, block and delete cookies, usually under privacy or site settings. You can block ours if you wish, but be aware that af_session is what keeps you signed in: block or delete it and you will be signed out and unable to sign back in until you allow it again. The public pages of this website — everything you can read without an account — work with cookies blocked entirely, analytics included.

If we add a cookie, we will list it here and change the date at the top of this page before it is set. Where a new cookie is not strictly necessary, we will ask for your consent first rather than relying on this page having been updated.

Questions about this policy, or about anything we store, can go to support@afads.tech. Our privacy policy covers the information we hold beyond cookies, and our terms of service cover the service itself.