Cookie & Browser Storage Policy
Last updated: September 23, 2026
This notice describes browser storage used by the TradeProof V1.2 website and app. See our Privacy Policy for information about other personal data.
Sign-in and security cookies
TradeProof uses first-party cookies to keep you signed in and protect sign-in requests. The app stores its session in an HttpOnly cookie, which ordinary page scripts cannot read. It does not store your session token, password, or account profile in local storage.
| Cookie | Purpose | Lifetime |
|---|---|---|
tp_session | Keeps your authenticated session. | Up to one hour; removed when you sign out. |
tp_gcp_csrf | Helps protect sign-in requests from another website. | Up to ten minutes; removed after successful sign-in or sign-out. |
tp_gcp_flow | Connects an email-link request to the browser that started it. | Up to ten minutes; removed after successful sign-in or sign-out. |
These cookies use Secure on the HTTPS service and SameSite=Lax. If your deployment uses the earlier identity provider, short-lived tp_pkce, tp_state, and tp_nonce cookies protect that sign-in flow, and tp_uid caches an account identifier. Blocking necessary cookies can prevent sign-in.
Preferences stored in your browser
Local storage remembers dismissed onboarding and upgrade notices, which product updates you have read, and an optional-analytics opt-out preference. Some preferences are associated with an account identifier so different users of the same browser can have different settings. These entries remain until you clear site data or the app removes or replaces them.
Session storage remembers a search-results link so you can return to the same search from a record. It can contain your search terms and filters. Session storage is normally cleared when the tab or window closes. Local and session storage are not sent automatically with every request.
Optional analytics and privacy signals
Optional product analytics are disabled by default. When enabled, the app's analytics code honors Global Privacy Control and the browser's stored TradeProof analytics opt-out. This choice concerns optional usage analytics; necessary authentication, security, billing, and operational records are handled separately. A privacy signal does not delete an account or submit a request to access or delete personal data.
Other providers
Google provides email-link authentication, Stripe hosts checkout and billing management, and Cloudflare provides delivery and security services. When you use those services, they may use cookies or similar technologies under their own policies. Their storage can depend on the page, your browser settings, and security checks. See Google's privacy policy, Stripe's privacy policy, and Cloudflare's privacy policy.
Your controls
Use Sign out to end your app session. Signing out does not clear every saved browser preference. To remove those preferences as well, use your browser's settings to clear cookies and site data for the TradeProof address you visited. You can manage provider cookies separately. Clearing site data signs you out and may cause onboarding or product notices to appear again.
Browser controls can block cookies or clear storage. Blocking necessary storage can affect sign-in, returning to search results, security checks, or payment flows. Check your browser's help for the controls available on your device.
Changes and contact
We update this notice when these storage practices change and show the revision date above. Contact [email protected] with questions about browser storage.