Privacy and storage

Cookie Policy

See what the platform stores, why it is needed, and when optional analytics can run.

Policy version 2

How we use storage

Essential storage is used for security and requested platform features. Analytics is opt-in.

Analytics off by default

About this Cookie and Storage Policy

This policy explains how this platform uses cookies and similar browser storage, why each type is needed, and the choices available to you. It should be read together with the platform's Privacy Policy and Terms, which cover account, transaction, identity-verification, and other personal data.

What this policy covers

For clarity, the word storage in this policy includes HTTP cookies, local browser preferences, temporary session storage, and the limited cache used by the Progressive Web App (PWA). The detailed inventory below identifies the main storage types, their purpose, category, and typical retention.

Essential cookies and storage

Essential storage is required to provide the service you request and to protect the platform. It is always active and is not used for advertising. Depending on the features you use, it may:

  • maintain your authenticated session and protect state-changing requests;
  • remember a persistent sign-in only when you select that option;
  • retain requested language, theme, chart, timeframe, market, and workspace preferences;
  • support platform reliability and cache public PWA assets; and
  • store your cookie choice so the platform can respect it.

If essential storage is blocked or cleared, sign-in and other core features may stop working or return to their defaults.

Optional analytics

Google Analytics is the only optional analytics integration currently controlled by this consent center. It is disabled by default. The Google Analytics script is not requested until you choose Accept all or enable Analytics under Manage preferences.

When allowed, analytics may process information such as pages viewed, interaction events, timestamps, referral information, browser and device characteristics, language, and an approximate region derived from network information. We configure advertising storage, advertising user data, and advertising personalization as denied.

Analytics information helps us understand aggregate platform usage, diagnose usability issues, and improve performance. It is not required to sign in, fund an account, place a trade, or use the core platform.

Browser preferences and PWA cache

First-party browser preferences remember settings that you explicitly choose, such as the platform theme, chart type, timeframe, and workspace controls. The PWA cache is limited to versioned public assets used for installability and resilience. Private account pages and API responses are excluded from that cache.

Your choices and controls

You can choose Accept all, Reject non-essential, or review the individual category in Manage preferences. Rejecting analytics does not reduce access to core platform features.

You can change your choice at any time by selecting Manage cookie preferences at the top of this page. When analytics is revoked, the platform sends a denied consent state, removes accessible first-party Google Analytics cookies, and reloads the page when necessary so the analytics runtime is no longer active. Clearing your browser data will also remove the saved choice and cause the consent request to appear again.

How long storage is retained

Retention depends on the storage type and the setting selected by the administrator. The current values are shown in the inventory below. The consent record is retained for the configured period between 30 and 365 days, but a new policy version immediately invalidates the previous choice and asks you again. Session storage normally ends with the session, while requested browser preferences remain until changed or cleared. When analytics is allowed, its provider-managed cookies may remain for the period shown in the inventory unless you revoke consent or clear them sooner.

Security and data minimization

The consent record contains only the policy version, the essential-storage marker, your analytics choice, and the decision timestamp. It is protected as an encrypted, Secure, HttpOnly, host-only cookie with a root path and SameSite protection. The consent decision is not copied into local storage or a separate server-side consent profile.

Third-party services

If analytics is enabled and you allow it, Google processes analytics data under its own privacy terms. Payment, authentication, identity-verification, market-data, and other operational providers are not authorized by the Analytics choice; those services are used only where required for their separate platform functions and are addressed by the applicable Privacy Policy and Terms.

Changes to this policy

We may update this policy when storage practices, providers, legal requirements, or platform features change. Material policy updates increase the policy version, invalidate the earlier decision, and present the consent choices again.

Contact

If you have questions about this policy, stored browser data, or your privacy choices, please contact the platform's support team using the contact page.

Names can include framework-generated suffixes. Retention can end sooner when you sign out, clear browser data, or revoke consent.

Storage Purpose Category Typical retention
Session cookie Maintains sign-in state, security checks, and server-side session continuity. Essential Session or configured session lifetime
CSRF security token Protects forms and state-changing requests against cross-site request forgery. Essential Session
__Host-bx_consent Stores the current policy version and your analytics choice in an encrypted HttpOnly record. Essential 90 days
Remember sign-in token Used only when persistent sign-in is requested; the raw account password is never stored. Essential / requested Until expiry, sign-out, or revocation
First-party browser preferences Remembers requested theme, chart type, timeframe, market state, trade controls, and temporary workspace positions. Essential / requested Until changed or browser data is cleared
PWA cache Caches public branding assets for installability and resilience; private account and API routes are excluded. Essential functionality Versioned; replaced during service-worker updates
_ga, _ga_* Google Analytics aggregate usage measurement. The script is not requested before opt-in consent. Analytics (optional) Provider managed; commonly up to 2 years

Change your mind

Use the Manage cookie preferences button at the top of this page. Revoking analytics deletes accessible first-party Google Analytics cookies and reloads the page when needed to stop the loaded analytics runtime.

Data minimization

The consent record contains only the policy version, required-storage marker, analytics choice, and decision timestamp. It is not written to local storage or a separate consent profile.

Questions about privacy or stored data? Contact support.

Contact support