One essential cookie. No advertising trackers.

A cookie is a small value a website asks a browser to return on later requests. The current GainHub NG application uses one first-party cookie after successful account registration or sign-in. Browsing public pages does not require that cookie.

• HttpOnly: browser scripts cannot read the cookie.
• Secure: production browsers send it only over HTTPS.
• SameSite=Lax: this limits cross-site sending while preserving ordinary navigation.
• Path=/ and host-only: it applies to this site and is not shared across arbitrary subdomains.
• Opaque value: the browser holds a random token; the database stores only its SHA-256 hash.

The server may expire or revoke a session earlier for sign-out, account restriction, security or maintenance. Expired server-side session records are removed by scheduled cleanup.

The repository does not currently set:

• advertising, retargeting or cross-site tracking cookies;
• analytics cookies;
• personalisation or preference cookies; or
• third-party social-media pixels.

Contact-channel events used for business workspace totals rely on a salted, one-directional network-address hash rather than an advertising cookie. Public links to WhatsApp or other external services may lead to sites with their own cookie practices.

Because the session cookie is strictly necessary for requested account functions, the current application does not show a cosmetic “accept cookies” banner. You can refuse or delete it in browser settings, but sign-in, saved listings, claims, owner workspaces and other private routes will stop working or sign you out.

You can also use the in-product sign-out action, which asks the server to revoke the current session and clear the cookie.

New non-essential browser storage must not be introduced silently. This notice and the product's consent controls must be updated before optional analytics, advertising or preference cookies are enabled where consent is required.

See the privacy notice for the wider data lifecycle.