Cookie Policy
Last updated: September 11, 2026
This policy lists every cookie and similar technology Flatswaps uses, what each one does and how long it lasts. It supplements our Privacy Policy and reflects Art. 5(3) of the ePrivacy Directive 2002/58/EC as implemented in Ireland by S.I. No. 336/2011, together with the consent standard of the GDPR.
1. How we handle cookies
We set only strictly necessary cookies until you tell us otherwise. Nothing in the measurement category loads before you opt in, and rejecting is exactly as easy as accepting — the banner gives both choices equal prominence, with no pre-ticked boxes and no nagging if you decline.
We use no advertising or tracking cookies at all. We do not run retargeting pixels, we do not share data with ad networks, and we do not build advertising profiles.
2. Strictly necessary — no consent required
These are needed to deliver the service you asked for, so Art. 5(3) ePrivacy exempts them from the consent requirement. They cannot be switched off without breaking the site.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| sb-<project>-auth-token | Flatswaps (Supabase) | Keeps you signed in and authorises requests to your own data. Without it you would be logged out on every page load. | 1 year, refreshed while you stay active |
| fs_signed_in | Flatswaps | A flag telling the server you have a session, so signed-in pages render correctly on first load instead of flashing the logged-out view. Contains no identifier. | 7 days |
| fs_consent_id | Flatswaps | A random identifier linking your device to the record of the cookie choice you made, so we can demonstrate valid consent under Art. 7(1) GDPR. | 3 years |
| fs-cookie-consent-<version> | Flatswaps | Stores your actual cookie choice in your browser's local storage so the banner is not shown again. Cleared automatically when we publish a new policy version. | 1 year (local storage) |
| NEXT_LOCALE | Flatswaps | Remembers the language you selected so the site opens in it next time. | 1 year |
3. Measurement — only with your consent
This category loads only if you opt in, and you can withdraw at any time with the button below. Withdrawing is as easy as giving consent, as Art. 7(3) GDPR requires.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Vercel Web Analytics | Vercel Inc. | Counts page views and referrers so we can see which pages are useful. It is a cookieless script: it sets no cookie and creates no cross-site identifier, but it does process your IP address and user agent to derive an anonymous, daily-rotating visitor hash. We load it only if you opt in. | No cookie set; aggregated data retained 25 months |
4. Third-party content on our pages
Some features load resources from other companies. They do not set cookies on our pages, but they do receive your IP address as a technical necessity of delivering the content:
- Mapbox — renders the interactive maps on listing and explore pages. Loaded only on pages that show a map.
- Stripe and PayPal — load their payment forms at checkout. They set their own cookies for fraud prevention, which is strictly necessary for the payment you requested. Their own privacy notices govern that processing.
5. Changing your choice
You can review or change your cookie settings at any time — there is no penalty for changing your mind, and no feature depends on it.
You can also delete cookies through your browser settings, and most browsers let you block them entirely. Blocking the strictly necessary ones will log you out and may break parts of the site.
We keep a record of each consent choice — the categories you granted, the policy version, your locale, a salted hash of your IP address and your user agent — for 3 years, solely to demonstrate that consent was validly obtained. We store a salted hash rather than your actual IP address so the record cannot be used to identify or track you.
6. Do Not Track and Global Privacy Control
Because we load nothing in the measurement category without an explicit opt-in, a browser signal such as Do Not Track or Global Privacy Control produces the same outcome as declining: no non-essential technology runs.
7. Changes and contact
When we add or remove a cookie we publish a new version of this policy. Because your stored choice is tied to the policy version, a new version asks you to choose again rather than silently carrying over an old consent.
Questions about cookies: privacy@flatswaps.com.