Cookie Policy

What we mean by “cookies”

Cookies are small pieces of data a website stores in your browser. This policy also covers localStorage, sessionStorage and IndexedDB — all of which are functionally similar for privacy purposes.

What we use

Stamposa uses only what is necessary to run the service. We do NOT set any analytics or advertising trackers.

Marketing site (stamposa.com)

The marketing site uses no cookies and stores a single theme preference (light / dark) in localStorage so the site keeps the theme you chose. That preference stays in your browser and is never sent to us.

App (app.stamposa.com)

• Session tokens — stored in localStorage under the keys loyalty.session.merchant, loyalty.session.staff and loyalty.session.customer. Contain a short-lived access token (15 minutes) and a refresh token (30 days). Required to keep you signed in. We are moving these to HTTP-only cookies for stronger XSS protection; when we do, this section will be updated.
• Theme preference — same as on the marketing site.
• Draft state — some forms keep an unsent draft in sessionStorage so a refresh does not lose your work; it is cleared when the tab closes.

API (api.stamposa.com)

The API sets no cookies today. Bearer tokens travel in the Authorization header of each request.

Third-party cookies

None on the marketing site or the app. Wallet passes (Apple / Google Wallet) are installed to the phone’s wallet app, not to your browser. Dodo Payments, our billing provider, may set its own cookies during checkout; that happens on Dodo’s domain and is governed by their privacy policy.

How to opt out

Because we only use what is strictly necessary, there is no consent banner. If you want to clear the local session, sign out from the app or clear site data from your browser settings — you will simply need to sign in again.

Changes

If we add any category of storage beyond what is listed above (analytics, ads or similar) we will publish a consent banner and update this page.