The short version
TrustForge uses only essential and functional cookies needed to operate the site. We do not set marketing cookies. We do not run cross-site trackers. We do not share cookie data with advertising networks. There is no cookie-consent banner because, under GDPR + ePrivacy, none of our cookies require one — they all fall under the strictly-necessary or user-action-driven exceptions.
What we set
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
sb-access-token / sb-refresh-token | Supabase auth session tokens — keep you logged in across page loads. Without these, you'd have to sign in on every navigation. HttpOnly + Secure flags set; not readable from JavaScript. | ~1 hour (access) / 7 days (refresh) | essential |
tf_currency | Stores your selected display currency so prices render in the same currency on every page. Set only when you actively change the currency in the header dropdown. | 1 year | functional |
localStorage (similar technology)
We also use the browser's localStorage for some UI-state items. These never leave your browser — we don't read them server-side or sync them across devices. Listed here for transparency because the ePrivacy framework treats "similar technologies" the same way as cookies.
| Key | Purpose |
|---|---|
trustforge-sound-enabled | Whether you've enabled the notification sound for new chat messages. Default off. |
trustforge-notif-banner-dismissed | Hides the one-time notification-permission prompt after you've dismissed it. |
trustforge-first-trade-banner-{orderId} | One per order — remembers that you've already dismissed the fair-trading safety banner for that order's chat. |
tf_seen_{hint} | Tracks dismissible one-time hints (e.g. 'save this shop' onboarding tip) so we don't keep showing them. |
trustforge-admin-widget-pos | Admin-only. Remembers where you've dragged the admin floating widget on the screen. |
Clearing browser storage (or using incognito mode) removes these. Nothing here is required to log in or trade — your preferences just reset to defaults.
Third-party cookies from payment processing
When you go through checkout, Stripe sets its own cookies in an iframe on the payment form for fraud-prevention purposes (Stripe Radar). Those cookies are controlled by Stripe, not by us; see Stripe's cookie policy. We do not set or read cookies on third-party domains.
Controlling cookies
You can clear cookies and localStorage from your browser settings at any time. Clearing the Supabase auth cookies will log you out; clearing tf_currency resets your display-currency preference; clearing the localStorage items resets dismissed banners and the admin widget position.
If you'd rather not have any cookies set at all, you can browse the public parts of TrustForge (landing, browse, categories, individual listings) in a privacy/incognito mode — but you won't be able to log in or trade without accepting essential cookies.
Questions
If anything in this policy is unclear or you spot a cookie we've missed, let us know.