Cookie Policy

A cookie is a small file a website saves in your browser to remember information between pages or visits, such as your signed-in session or your language. This policy also covers similar technologies, such as the browser's local storage (localStorage).

These are needed for the site to work or to remember something you've chosen, so they don't require your consent (Art. 22.2 of Spain's LSSI-CE). They are all first-party cookies on swiftbol.com:

sb-…-auth-token (may be split into several parts: .0, .1…). Provider: Supabase, on behalf of SwiftBOL. Purpose: keeping you securely signed in. Duration: up to 400 days, or until you sign out.

sb-…-auth-token-code-verifier. Provider: Supabase, on behalf of SwiftBOL. Purpose: securely completing sign-up, email confirmation or sign-in. Duration: temporary; deleted once that step is finished.

If you sign in with Google, you spend a few seconds on Google's pages during sign-in, which use their own cookies on their domains (such as google.com) under Google's privacy policy. SwiftBOL doesn't set or read Google cookies because of this.

swiftbol_locale. Provider: SwiftBOL. Purpose: remembering the language of the site and the dashboard (Spanish or English). The first time, we pick it based on the country you're connecting from, which our hosting provider infers from your IP without us storing it. Duration: 1 year.

In addition, if our hosting provider's firewall (Vercel) needs to check that you're a person and not a bot, it may set a short-lived security cookie.

swiftbol_ref. Provider: SwiftBOL (first-party cookie). Purpose: if you reach SwiftBOL through an invite link (an address with “?ref=”), it remembers the referrer's code so that, if you sign up, the sign-up is credited to them in the referral program (section 13 of the Terms). It only contains that code, no data about you, and isn't shared with anyone. Duration: 30 days. If you don't want it used, delete it from your browser before signing up.

swiftbol-consent-v2. Purpose: remembering whether you accepted or rejected measurement cookies, so we don't ask on every page. It stays in your browser for 12 months (then we ask again), or until you change your choice or clear the site's data.

swiftbol-cards:… (one entry per flashcard deck). Purpose: remembering on your device which flashcards you missed last time, so you can review them. It stays in your browser until you clear the site's data and is never sent to our servers.

swiftbol-inapp-notice-dismissed (session storage). Purpose: not showing you again, during that visit, the notice that you're inside another app's built-in browser (Instagram, Google…). It is deleted when you close the tab.

swiftbol-cookies-later (session storage). Purpose: if you tap “Not now” on the cookie notice, not showing it again during that visit. It stores no choice: the notice comes back on your next visit. It is deleted when you close the tab.

We use Vercel Web Analytics to count visits and see which pages are viewed most, in aggregate. It sets no cookies and stores no identifiers in your browser, so it doesn't require your consent.

We also run our own visit statistics: while you have a page open, the site tells our server which page it is (every 30 seconds). It sets no cookies and doesn't store or read anything stored in your browser, and we don't keep your IP: only a pseudonymous code that changes every day, the approximate city, the type of device and where you came from. It is deleted after 60 days. If your browser sends the Global Privacy Control signal, these signals aren't sent. More detail in the Privacy Policy.

We use the Google Ads tag (provider: Google Ireland Limited, acting as an independent controller) in Google's “advanced consent mode” to learn which ads bring visits, sign-ups and subscriptions to SwiftBOL. Until you have decided, the tag loads with every permission denied: it doesn't store or read cookies in your browser and only sends Google technical signals without cookies or advertising identifiers (for example, that a page loaded), which Google uses to estimate results in aggregate. Like any internet request, those signals carry your IP address and browser details. We ask inside your account, when you open the dashboard (on the public site we don't show the notice so it doesn't cover the content, but you can decide at any time from “Cookie settings” at the bottom of the page). If you press “Accept”, it can use the cookies described below; if you press “Reject” or your browser sends the Global Privacy Control signal, the tag doesn't load. Ad personalisation is always off, and the tag doesn't load on shared public links (/share) or on sign-in links (/auth).

Cookies it may set: _gcl_au and _gcl_aw, on swiftbol.com (90 days), which link a visit or sign-up to the ad you clicked; and IDE and test_cookie, on Google domains such as doubleclick.net (up to 13 months in the EEA and UK, 24 months elsewhere; and 15 minutes), to measure conversions and check that your browser accepts cookies. Type: third-party, advertising (measurement).

Google may process your IP address, browser details and the page you came from, and transfer them to the United States under the EU-US Data Privacy Framework. More on how Google uses this data: policies.google.com/technologies/partner-sites.

Quick sign-in with Google (“Continue as…”): when it's enabled and you've pressed “Accept”, Google may show its prompt on the sign-in page so you can sign in with your account in one click. To do so Google (an independent controller) reads its own cookies on accounts.google.com to know whether you're signed in, and may store the g_state cookie on swiftbol.com, which only remembers whether you closed the prompt so it isn't shown again right away (duration: as set by Google). Without your consent the prompt doesn't load; the “Continue with Google” and “Continue with Microsoft” buttons work the same and only use cookies when you press them.

You can change your mind at any time from the “Cookie settings” link at the bottom of the site (for example, on this page). If you withdraw your consent, the Google Ads tag stops using cookies immediately, we delete its _gcl_ cookies from swiftbol.com, and it stops loading as soon as you reload or reopen the site; you can delete any cookies on Google's domains from your browser.

You can also delete or block cookies in your browser settings (Chrome, Safari, Firefox, Edge…). If you block technical cookies, you won't be able to sign in or use the SwiftBOL dashboard.

To learn what personal data we process, on what legal basis and how to exercise your rights, see the Privacy Policy or write to support@swiftbol.com.