Cookie Policy

Last updated: September 2026

1. What this Cookie Policy covers

This Cookie Policy explains how Swipe uses cookies, similar technologies, and browser-side storage in the web application. It supplements the Privacy Policy and describes in particular which technologies are used for login, session management, security, and certain convenience features, and which technologies we use for statistics and marketing only with your consent.

This Cookie Policy applies to the use of the Swipe web application under the domains swipe-service.de and swipe-service.ae. Browser cookies do not apply in the same way to the native mobile apps; those apps use app-specific token and device-storage mechanisms instead.

2. What are cookies and similar technologies?

Cookies are small text files stored on your device by your browser. Similar technologies include Local Storage, Session Storage, and other browser-side storage mechanisms that can keep information available for later requests.

These technologies may either apply only to the current session or remain stored beyond the session until they expire automatically or are deleted by you.

3. Which technologies we currently use

We divide the technologies used in the web application into three categories, which you will also find in our cookie banner: Necessary, Statistics, and Marketing. Only necessary technologies are active without your consent. Statistics and marketing technologies are only used once you have consented to the relevant category (see section 5).

3.1 Necessary cookies set by Swipe

Swipe uses the following cookies for authentication, session management, security, and protection against abusive requests:

• jwt (provider: Swipe): access cookie that identifies you as a logged-in user in the web application and associates realtime features with your account. Session cookie: it is deleted when you log out or when your browser session ends; the short-lived access token it contains is renewed automatically.
• refresh_token (provider: Swipe): allows your session to be renewed without logging in again. Session cookie; if you select "Remember me" when logging in, it is stored for up to 30 days. It is deleted when you log out.
• XSRF-TOKEN (provider: Swipe): protects protected requests against cross-site request forgery (CSRF). Session cookie.

3.2 Necessary browser-side storage

The web application also stores the following entries in your browser:

• swipe_cookie_consent (Local Storage, provider: Swipe): your choice in the cookie banner (the categories you allowed, the time of your decision, the version of the banner, and a random consent ID), so that we can respect your choice and do not ask again on every visit. If you change or withdraw your choice, the entry is updated; it is stored until you delete it in your browser. So that we can prove your consent, our server also records each choice with the same consent ID, the time, the version, and the categories, without your IP address or user account, and deletes these records after three years (see our Privacy Policy, section 14.2).
• language and swipe-theme (Local Storage, provider: Swipe): your chosen language and the light or dark display. Stored until you delete them.
• swipe.returnTarget (Local Storage), swipe.publicReturnUrl and swipe.publicReturnScrollY (Session Storage) (provider: Swipe): take you back to the page and scroll position you came from, for example after logging in or registering. The Local Storage entry is removed once it has been used; the Session Storage entries are deleted when you close the tab.
• swipe.urlSecrets (Session Storage, provider: Swipe): if you open a link from one of our emails that contains a one-time token or your email address, for example to reset your password, we remove these values from the page address as soon as the page loads and keep them in this entry. This way they are not transmitted to analytics or advertising services as part of the page address and remain available if you reload the page. Deleted when you close the tab.
• swipe.create-post.draft (Session Storage) and the browser database swipe-create-post (IndexedDB) (provider: Swipe): a temporary draft of the request you are creating, including selected photos, so that nothing is lost when you switch pages. The draft is deleted when the request is submitted or the tab is closed; stored photos are removed when the request is submitted, and entries older than 24 hours are discarded automatically the next time the form is used.

3.3 Statistics (only with your consent): Google Analytics 4

If you consent to the "Statistics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics then sets the following cookies on our domain:

• _ga (provider: Google): distinguishes visitors by means of a randomly generated identifier. Lifetime: up to 2 years.
• _ga_L7CH7TBGYY on swipe-service.de or _ga_Z9DX0K2DZ6 on swipe-service.ae (provider: Google): keeps the state of the current session. Lifetime: up to 2 years.

Without this consent, Google Analytics is not loaded and no connection to Google is established. If you withdraw your consent, no further data is sent to Google from that moment on.

3.4 Marketing (only with your consent): Meta Pixel

If you consent to the "Marketing" category, we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Without this consent, the Meta Pixel is not loaded and no connection to Meta is established. The Meta Pixel sets the following cookies on our domain:

• _fbp (provider: Meta): recognizes your browser in order to measure and optimize our advertising on Facebook and Instagram. Lifetime: up to 90 days.
• _fbc (provider: Meta): is only set if you reach our website by clicking on one of our ads on Facebook or Instagram, and stores the click identifier. Lifetime: set by Meta (Meta recommends 90 days for this cookie).

Depending on your browser settings, Meta may also read or set its own cookies on Meta domains, for example if you are logged in to Facebook or Instagram in the same browser. This is governed by Meta's cookie policy.

3.5 Third-party services in individual functions

• Stripe: if you verify your identity as a provider or make a payment, the web application loads Stripe.js from Stripe. Stripe uses necessary cookies for fraud prevention, according to Stripe's cookie list in particular __stripe_mid (1 year) and __stripe_sid (30 minutes).
• Cloudflare Turnstile: if you use the "Auto-fill" function without being logged in, a security check by Cloudflare, Inc. is loaded, which distinguishes people from automated requests. Turnstile is only loaded for this function. According to Cloudflare, Turnstile uses cookies and local storage to maintain the state of the check.

3.6 Native mobile apps

According to the current product setup, the native iOS and Android apps do not use browser cookies for login or session management. Instead, they use app-specific token and storage mechanisms that are technically different from browser cookies.

The statistics and marketing technologies described in sections 3.3 and 3.4 are currently only used in the web application; the apps do not contain Google Analytics or the Meta Pixel.

4. Why we use these technologies

We use cookies and similar technologies in particular for the following purposes:

• providing and securing the login process in the web application
• recognizing users who are already signed in on the web
• continuing and refreshing existing sessions
• protecting the platform against CSRF, automated requests, and similar abuse attempts
• supporting technical convenience features such as language settings and temporary drafts
• supporting internal navigation and return behavior in the web application
• storing your cookie choice
• statistical analysis of how our website is used, so that we can improve it (only with your consent)
• measuring and optimizing our advertising on Facebook and Instagram (only with your consent)

5. Your choice: consent, changes, and withdrawal

When you first visit our website, a cookie banner asks for your choice. You can accept all categories, reject all optional categories with one click, or select individual categories under "Settings". The "Statistics" and "Marketing" categories are switched off until you actively switch them on. The website can also be used without your consent.

You can change or withdraw your choice at any time with effect for the future. To do so, open the cookie settings via the "Cookie settings" link in the footer of our website. There you will see the categories with your current choice: switch off the categories you no longer want and select "Save selection", or select "Reject all". Alternatively, you can delete the entry swipe_cookie_consent or all website data for our domain in your browser settings; the cookie banner will then appear again on your next visit.

After a withdrawal, Google Analytics no longer sets or reads analytics cookies and the Meta Pixel no longer transmits any data. Cookies that have already been set remain in your browser until they expire, unless you delete them in your browser settings.

If the technologies or providers we use change, we may ask for your choice again.

6. Legal bases

Where German law applies, we store necessary cookies and similar technologies on your device, or access them, on the basis of Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because this is strictly necessary to provide the web functions you have requested. The associated processing of personal data is based on Article 6(1)(b) and (f) GDPR, insofar as it is necessary to provide the requested web functions, manage sessions, and protect the security and integrity of the platform.

We only use statistics and marketing technologies on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future (see section 5).

Where applicable data protection law in the United Arab Emirates applies, required technologies are used within the legally permitted processing cases thereunder, in particular to provide the requested services, perform contractual obligations, and protect our platform and users. We only use statistics and marketing technologies on the basis of your consent.

7. Retention periods

The exact retention period depends on the relevant technology and function:

• The cookies jwt and XSRF-TOKEN are session cookies and are deleted when your browser session ends or when you log out.
• The refresh_token cookie is a session cookie; if you select "Remember me", it is stored for up to 30 days, until it expires or is revoked.
• Entries in Local Storage, Session Storage, or IndexedDB are stored as described in section 3.2, until they are overwritten technically, removed automatically, or deleted by you or your browser.
• The Google Analytics cookies _ga and _ga_L7CH7TBGYY or _ga_Z9DX0K2DZ6 are stored for up to 2 years.
• The Meta Pixel cookie _fbp is stored for up to 90 days; the lifetime of _fbc is set by Meta (Meta recommends 90 days).
• Stripe's cookies are stored for the periods set by Stripe (__stripe_mid 1 year, __stripe_sid 30 minutes).

How long Google and Meta store the data collected in this way on their servers is explained in our Privacy Policy.

8. Third parties and technically integrated services

Some functions of the web application establish technical connections to third parties, for example to Stripe for payment and verification functions, to Cloudflare for the security check in the "Auto-fill" function, to Google for font or icon resources and for the Google tag, and to OpenStreetMap for map tiles. Whether and to what extent such third parties use their own cookies or similar technologies on their own domains is governed by their own privacy and cookie notices.

For the Meta Pixel, we and Meta are joint controllers for the collection of data on our website and its transmission to Meta. Details on this, on Google Analytics, and on transfers of data to the USA can be found in our Privacy Policy.

9. Management and disabling

You can manage, restrict, or delete cookies in your browser. You can also clear Local Storage, Session Storage, and IndexedDB through your browser settings. You can change your choice regarding statistics and marketing technologies at any time as described in section 5.

Please note, however, that disabling or deleting required cookies and storage mechanisms may prevent login, session continuation, security functions, or other parts of the web application from working properly.

10. Contact

If you have any questions about this Cookie Policy, you can contact us using the support options in the app or on the website. The provider responsible for the market you are using, together with its contact details, is listed in the imprint (legal notice).

11. Currency and changes to this Cookie Policy

We update this Cookie Policy if the technologies used in the web application, the product functions, or the legal requirements change. The current version published on the platform shall apply.