COOKIE & DATA COLLECTION POLICY
Effective Date: January 26, 2026
Last Updated: August 5, 2026
INTRODUCTION
This notice explains how bmazed uses cookies and similar technologies to collect and store information when you use our service. We are committed to transparency about the technologies we use and the data we collect.
1. WHAT ARE COOKIES?
Cookies are small text files stored on your device when you visit a website or use an app. They help us remember your preferences and provide a better experience. Similar technologies include local storage, session storage, and device identifiers.
2. COOKIES WE USE
2.1 Essential Cookies
Required for authentication and session management. These keep you logged in and secure. Essential cookies cannot be disabled as they are necessary for the service to function.
2.2 Preference Cookies
Remember your settings like theme (dark/light mode), language preferences, and accessibility settings.
2.3 Security Cookies
Used for fraud prevention, CSRF protection, and rate limiting to protect your account from unauthorized access.
3. DATA COLLECTED VIA COOKIES
Through cookies and similar technologies, we collect:
- Session Identifiers: For authentication and maintaining your logged-in state.
- Device & Browser Information: Device type, operating system, and browser version.
- IP Address: For security purposes, stored as a one-way hash (not in raw form).
- Usage Patterns: Timestamps and feature interaction data to improve the service.
4. LOCAL STORAGE
We also use browser local storage to cache application data for faster performance and to store your preferences locally. This data remains on your device and includes:
- Theme Preferences: Your selected color scheme and display mode.
- Notification Settings: Your notification preferences.
- UI Customizations: Layout and accessibility settings.
- Cache Data: Temporary storage of feed content and user profiles to improve loading times.
5. THIRD-PARTY COOKIES
We may use cookies from the following third-party services:
- Authentication Providers (Apple): When you choose to sign in with Apple, that provider may set its own cookies as part of the OAuth sign-in flow. bmazed does not control these cookies; please refer to the provider's privacy policy.
- Payment Processors (Stripe): For secure payment processing and subscription management. Stripe may set its own cookies during checkout.
- Security Services (Cloudflare Turnstile): For CAPTCHA verification and bot protection. Cloudflare may set cookies to validate requests.
No Advertising Cookies
bmazed does not use any advertising or tracking cookies. We do not serve ads, and we do not share cookie data with advertising networks.
6. COOKIE DURATION
- Session Cookies: Set to expire automatically 7 days after you log in, regardless of activity in between. Closing your browser does not extend or shorten this period.
- Persistent Cookies: Preferences stored for up to 12 months.
- Consent Record: Your cookie consent choice is stored for 12 months before we ask again.
7. COOKIE SECURITY
We implement strict security measures for all cookies:
- HttpOnly: Session cookies cannot be accessed by JavaScript, protecting against XSS attacks.
- Secure Flag: Cookies are only transmitted over encrypted HTTPS connections in production.
- SameSite=Lax: Blocks the session cookie from being sent on most cross-site requests. We additionally enforce a per-session CSRF token on every state-changing API request as our primary CSRF defense.
- Consistent Naming: All session cookies use consistent, predictable naming conventions.
7.1 KEEPING YOUR APP UP TO DATE
We recommend keeping bmazed updated to the latest version. Each release includes the most recent security patches, new features, and performance and reliability improvements that help protect your account and deliver the best possible experience.
Older versions may have reduced functionality, missing features, or known issues that have already been resolved in current releases. We encourage leaving automatic updates enabled in your browser or app store so you always have the latest version of bmazed.
8. YOUR CHOICES
You can manage cookies through:
- Browser Settings: Most browsers allow you to block or delete cookies. Refer to your browser's help documentation for instructions.
- App Settings: Go to Settings > Privacy to manage your preference controls within bmazed.
Important
Blocking essential cookies may prevent you from using the service, as they are required for authentication and core functionality.
8.1 CONSENT BY CONTINUED USE
If you are accessing bmazed from outside the European Economic Area (EEA) or the United Kingdom, no explicit cookie banner is displayed. By continuing to use the platform, you agree to the use of essential cookies as described in this policy. Essential cookies are strictly necessary for the service to function — they cannot be disabled without preventing you from using bmazed. This legal basis (contractual necessity and legitimate interest in operating a secure service) is documented in Section 10.1 below.
Visitors in the EU, EEA, or UK are shown an explicit cookie notice and may acknowledge or decline non-essential data collection. The Cookie Policy and Privacy Policy remain accessible from every page of the platform regardless of jurisdiction.
9. APPLICABLE LAW & CCPA COMPLIANCE
9.1 California Users (CCPA)
California residents have additional rights under CCPA. We do not sell personal information collected through cookies. For more details, see the California Privacy Rights section of our Privacy Policy.
9.2 Global Privacy Control (GPC)
bmazed does not sell personal information or share it for cross-context behavioral advertising, and we do not use cookies for advertising or tracking purposes. Because there is nothing to opt out of, a Global Privacy Control (GPC) signal does not change how your data is handled — you already have the protection a GPC opt-out would otherwise provide.
Our server reads the Sec-GPC: 1 request header sent by GPC-enabled browsers. When this signal is present, the server responds with X-GPC-Acknowledged: 1 to confirm receipt. We also publish a /.well-known/gpc.json discovery document so browsers can confirm GPC support before sending the signal.
9.3 Jurisdictional Scope
bmazed is available to users worldwide. Users in the European Economic Area, United Kingdom, Canada, and other jurisdictions may have additional rights regarding cookies and similar technologies under applicable local law. We comply with all applicable cookie consent and disclosure requirements in the jurisdictions we serve.
10. CHANGES TO THIS POLICY
If we make material changes to our cookie practices, we will update this page and reset the cookie consent banner so you can review and accept the updated terms. We will notify you of significant changes via in-app notification or email.
10.1 LEGAL BASIS FOR USING COOKIES
Where the General Data Protection Regulation (GDPR) or the UK GDPR applies, bmazed relies on the following legal bases for the cookies and similar technologies described above. Strictly necessary cookies (session, authentication, CSRF, and security cookies) are set on the basis of our legitimate interest in operating a secure service and on the contractual necessity of providing the service you have requested. Preference cookies are set on the basis of your consent, which you can withdraw at any time from in-app settings or by clearing your browser storage. Third-party cookies set by Stripe, Cloudflare Turnstile, or OAuth providers (Apple) during authentication and checkout are set on the basis of contractual necessity, since those flows cannot be completed without them.
We do not use cookies or similar technologies for online advertising, cross-site tracking, or building marketing profiles. We do not participate in real-time bidding networks, and we do not embed third-party advertising SDKs in our mobile apps. Because we do not monetise via advertising, the cookie tradeoff that exists on most large platforms — accept tracking or accept a degraded experience — simply does not apply on bmazed.
10.2 MOBILE DEVICE IDENTIFIERS
On the bmazed iOS and Android apps, we use the operating system's built-in secure storage (Keychain on iOS, EncryptedSharedPreferences on Android) to keep your session token between launches, instead of a browser cookie. We do not access the Identifier for Advertisers (IDFA) on iOS or the Google Advertising ID on Android. We do not call AppTrackingTransparency to request tracking permission because we have no use for the answer — bmazed does not perform cross-app tracking.
Push-notification tokens issued by Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) are stored against your account so we can deliver match alerts, message notifications, and event reminders. You can revoke push notifications at any time from your device settings or your in-app notification preferences; revoking them invalidates the stored token and we no longer attempt delivery.
11. CONTACT US
If you have questions about our cookie practices or this policy: