Cookie Policy

This policy explains the cookies and similar technologies used on botransfer.com and app.botransfer.com. A cookie is a small text file a website stores in your browser. "Local storage" is a similar feature that lets a site keep a small note in your browser. The law that covers both in the UK is the Privacy and Electronic Communications Regulations 2003 (PECR). It allows a site to store information that is strictly necessary to provide a service you have asked for without asking for consent. Everything listed below falls into that category.

1. Cookies we set

Name	What it does	How long
`sessionid`	Keeps you logged in, and remembers that you confirmed your email address with a code so you don't need a new code for every transfer. It holds a random reference, not your details.	30 days, or until you log out
`csrftoken`	Security. Proves that a request to send, delete or change something really came from our pages, protecting you from "cross-site request forgery" attacks.	1 year

Both are first-party cookies set on botransfer.com and its app subdomain, sent only over encrypted connections, and never used to track you across other websites.

2. Notes kept in your browser (local storage)

Name	What it does	How long
`bt:who`	Remembers whether you were last logged out, on Free or on Pro, so the app shows the right buttons as it opens instead of flickering. It contains only one of those three words.	Until you clear your browser data
`bt:got:…`	On a download page, remembers which files you have already downloaded on this device, so they stay ticked. It contains only the transfer's and files' random references.	Until you clear your browser data

These notes never leave your device and we cannot read them.

3. Services we use that run in your browser

Cloudflare Turnstile — our bot check, shown when you ask for an email code or send a transfer on the Free plan. It runs in a frame loaded from Cloudflare and may store small security items there (for example, to remember that you passed the check). These are used only to tell people from bots. See Cloudflare's Turnstile privacy addendum.
Paddle checkout — when you buy Pro, the payment window is provided by Paddle, our reseller. Paddle may set cookies needed to take payment safely and prevent fraud. See Paddle's privacy notice.
Google — only if you choose "Log in with Google". You are taken to Google's own site, where Google's cookies and privacy policy apply.

None of these load until you use the feature that needs them.

4. What we don't use

We use no analytics or statistics tools, no advertising or remarketing cookies, no social media widgets, no "pixels" in our emails, and no fingerprinting. If we ever want to add something that is not strictly necessary, we will ask for your consent first and update this policy.

5. Your choices

You can block or delete cookies and local storage in your browser settings. If you block our cookies you will not be able to log in, send transfers or open password-protected transfers, because the service cannot work securely without them.

6. Questions