Cookie & Device Storage Notice

Used for authentication, security, fraud prevention, network routing, baskets, checkout, language, accessibility and remembering your consent. These cannot be switched off through the consent panel because the requested service would not function safely without them.

Helps us understand performance, crashes and feature usage using aggregated or pseudonymous identifiers. Analytics storage is disabled until you consent where consent is required.

Remembers optional preferences and may tailor discovery or recommendations. Core saved-account settings requested by you may be necessary; broader personalisation is optional.

Measures campaigns or supports relevant advertising across services. Marketing storage is disabled unless you actively consent. Swipped does not treat silence, scrolling or continued use as consent.

• Swipped consent records: swipped_consent and swipped_consent_v1, retained for up to 365 days to remember your choices.
• NextAuth session, CSRF and callback cookies, retained for the session or the configured authentication period and used only for secure sign-in and navigation.
• Basket and interface storage such as addToOrderContext and userProfilePicture, kept until completion, sign-out or browser removal for requested features.
• Swipped first-party product analytics: swipped_analytics_anonymous_v1 and swipped_analytics_session_v1 on web, or encrypted swipped.analytics identifiers in the app. They are created only after analytics consent, deleted from the device on withdrawal, and sent only to /api/analytics/events.
• Stripe payment and connected-account technology, Plaid Identity Verification, Mapbox or MapLibre maps, Expo push delivery, AWS-hosted media, selected Unsplash imagery and the jsDelivr-hosted Font Awesome icon font load only for their stated necessary or requested feature; none is installed here as an advertising SDK.

Session storage expires when the session or browser ends. Consent records are normally kept for up to 365 days before we ask again unless you change them sooner. Consented raw client analytics events are kept for 90 days and server-confirmed operational outcomes for 400 days by default, after which raw records are deleted; aggregated reporting may be retained without a user-level identifier. Authentication, security and statutory transaction records use the separate proportionate periods in the Privacy Policy.

Use “Cookie settings” at the bottom of any web page. Rejecting is as easy as accepting. In the app, use Data & Privacy settings and the operating-system permission controls. Withdrawal applies from that point and does not make earlier lawful processing unlawful.

We update this notice when technologies or purposes materially change and will seek fresh consent where required. Questions can be sent to privacy@swipped.co.uk.