Cookie Policy

A cookie is a small file a website saves in your browser to remember information between pages or visits, such as your signed-in session or your language. This policy also covers similar technologies, such as the browser's local storage (localStorage).

These are needed for the site to work or to remember something you've chosen, so they don't require your consent (Art. 22.2 of Spain's LSSI-CE). They are all first-party cookies on swiftbol.com:

sb-…-auth-token (may be split into several parts: .0, .1…). Provider: Supabase, on behalf of SwiftBOL. Purpose: keeping you securely signed in. Duration: up to 400 days, or until you sign out.

sb-…-auth-token-code-verifier. Provider: Supabase, on behalf of SwiftBOL. Purpose: securely completing sign-up, email confirmation or sign-in. Duration: temporary; deleted once that step is finished.

If you sign in with Google, you spend a few seconds on Google's pages during sign-in, which use their own cookies on their domains (such as google.com) under Google's privacy policy. SwiftBOL doesn't set or read Google cookies because of this.

swiftbol_locale. Provider: SwiftBOL. Purpose: remembering the language of the dashboard and your account (Spanish, English, German, French, Italian or Portuguese). The first time, we pick it based on the country you're connecting from, which our hosting provider infers from your IP without us storing it. Duration: 1 year.

swiftbol_site_locale. Provider: SwiftBOL. Purpose: remembering the language you pick in the site's language menu (Spanish, English, German, French, Italian or Portuguese), so the home page is always shown to you in that language. It is only set if you use that menu; otherwise the language is chosen from the country you're connecting from and your browser's language, without storing anything. Duration: 1 year.

In addition, if our hosting provider's firewall (Vercel) needs to check that you're a person and not a bot, it may set a short-lived security cookie.

swiftbol_ref. Provider: SwiftBOL (first-party cookie). Purpose: if you reach SwiftBOL through an invite link (an address with “?ref=”), it remembers the referrer's code so that, if you sign up, the sign-up is credited to them in the referral program (section 13 of the Terms). It only contains that code, no data about you, and isn't shared with anyone. Duration: 30 days. If you don't want it used, delete it from your browser before signing up.

swiftbol-consent-v3. Purpose: remembering whether you accepted or rejected measurement cookies, so we don't ask on every page. It stays in your browser for 12 months (then we ask again), or until you change your choice or clear the site's data.

swiftbol-consent-region (session storage). Purpose: remembering during your visit whether, given the country you're connecting from, your permission is needed before Google's tag loads, so it isn't checked on every page. It only stores “prior” or “open” and is deleted when you close the tab.

swiftbol-cards:… (one entry per flashcard deck). Purpose: remembering on your device which flashcards you missed last time, so you can review them. It stays in your browser until you clear the site's data and is never sent to our servers.

swiftbol-inapp-notice-dismissed (session storage). Purpose: not showing you again, during that visit, the notice that you're inside another app's built-in browser (Instagram, Google…). It is deleted when you close the tab.

swiftbol-cookies-later (session storage). Purpose: if you tap “Not now” on the cookie notice, not showing it again during that visit. It stores no choice: the notice comes back on your next visit. It is deleted when you close the tab.

swiftbol-trial-promo-closed. Purpose: if you close the Standard plan free-trial notice, not showing it again for 7 days. It stores only the date you closed it and is never sent to our servers.

swiftbol-terms-later:… (session storage). Purpose: if you tap “Not now” on the updated-Terms notice in the dashboard, not showing it again during that visit. It is deleted when you close the tab.

swiftbol-purchase-… (one entry per payment). Purpose: not counting the same purchase twice in ad measurement if you reload the Billing page; it only has an effect if you accepted measurement cookies. It stores a “1” and is never sent to our servers.

swiftbol-chunk-reload (session storage). Purpose: if, after a site update, a file is missing in your browser, reloading the page once instead of showing an error. It is deleted when you close the tab.

We use Vercel Web Analytics to count visits and see which pages are viewed most, in aggregate. It sets no cookies and stores no identifiers in your browser, so it doesn't require your consent.

We also run our own visit statistics: while you have a page open, the site tells our server which page it is (every 30 seconds). It sets no cookies and doesn't store or read anything stored in your browser, and we don't keep your IP: only a pseudonymous code that changes every day, the approximate city, the type of device and where you came from. It is deleted after 60 days. If your browser sends the Global Privacy Control signal, these signals aren't sent. More detail in the Privacy Policy.

We use the Google Ads tag (provider: Google Ireland Limited, acting as an independent controller) in Google's “advanced consent mode” to learn which ads bring visits, sign-ups and subscriptions to SwiftBOL. In the European Economic Area, the UK and Switzerland (or if we can't tell which country you're visiting from), the tag doesn't load until you click “Accept”. In other countries, until you have decided, it loads with every permission denied: it doesn't store or read cookies in your browser and only sends Google technical signals without cookies or advertising identifiers (for example, that a page loaded), which Google uses to estimate results in aggregate. Like any internet request, those signals carry your IP address and browser details. We ask inside your account, when you open the dashboard (on the public site we don't show the notice so it doesn't cover the content, but you can decide at any time from “Cookie settings” at the bottom of the page). If you press “Accept”, it can use the cookies described below; if you press “Reject” or your browser sends the Global Privacy Control signal, the tag doesn't load. Ad personalisation is always off, and the tag doesn't load on shared public links (/share) or on sign-in links (/auth).

Cookies it may set: _gcl_au and _gcl_aw, on swiftbol.com (90 days), which link a visit or sign-up to the ad you clicked; and IDE and test_cookie, on Google domains such as doubleclick.net (up to 13 months in the EEA and UK, 24 months elsewhere; and 15 minutes), to measure conversions and check that your browser accepts cookies. Type: third-party, advertising (measurement).

Google may process your IP address, browser details and the page you came from, and transfer them to the United States under the EU-US Data Privacy Framework. More on how Google uses this data: policies.google.com/technologies/partner-sites.

Meta Pixel (provider: Meta Platforms Ireland Limited). We use it to learn which Facebook and Instagram ads bring sign-ups and subscriptions to SwiftBOL. It only loads after you press “Accept”, in every country: until you decide, if you press “Reject” or if your browser sends the Global Privacy Control signal, it doesn't load or send anything to Meta. With your permission, it tells Meta when you visit a page of the public site and when you create your account, start a free trial or pay; in the dashboard it only runs for those notices, and it doesn't load on shared links (/share) or sign-in links (/auth). We don't send it your name, your email or the content of your account.

Cookies it may set: _fbp, on swiftbol.com (90 days), which tells your browser apart to measure visits and sign-ups; and _fbc, on swiftbol.com (90 days), only if you arrive from a Meta ad, which stores that click's identifier. Meta's code creates and reads them. If you have a Facebook or Instagram account, Meta may also read its own cookies on its domains (such as facebook.com) and link this data to your account. Type: advertising (measurement).

Meta may process your IP address, browser details, the page visited and the notice sent, and transfer them to the United States under the EU-US Data Privacy Framework. We are joint controllers with Meta only for collecting this data and sending it to Meta; what Meta does with it afterwards, including using it for its own purposes such as improving and personalising the ads it shows, is Meta's responsibility under its privacy policy: facebook.com/privacy/policy.

Quick sign-in with Google (“Continue as…”): when it's enabled and you've pressed “Accept”, Google may show its prompt on the sign-in page so you can sign in with your account in one click. To do so Google (an independent controller) reads its own cookies on accounts.google.com to know whether you're signed in, and may store the g_state cookie on swiftbol.com, which only remembers whether you closed the prompt so it isn't shown again right away (duration: as set by Google). Without your consent the prompt doesn't load; the “Continue with Google” and “Continue with Microsoft” buttons work the same and only use cookies when you press them.

You can change your mind at any time from the “Cookie settings” link at the bottom of the site (for example, on this page). If you withdraw your consent, the Google Ads tag stops using cookies immediately, we delete its _gcl_ cookies from swiftbol.com, and it stops loading as soon as you reload or reopen the site; you can delete any cookies on Google's domains from your browser. The same goes for the Meta Pixel: it stops sending data immediately, we delete its _fbp and _fbc cookies from swiftbol.com, and it doesn't load again.

You can also delete or block cookies in your browser settings (Chrome, Safari, Firefox, Edge…). If you block technical cookies, you won't be able to sign in or use the SwiftBOL dashboard.

To learn what personal data we process, on what legal basis and how to exercise your rights, see the Privacy Policy or write to support@swiftbol.com.