Cookie Policy

Your choice

Pulltip separates Necessary, Analytics, Marketing and Personalization. Optional categories are off until you choose them. Accept all, Reject optional and Customize are available in the preference panel. You can change the choice through Cookie settings in the footer without creating an account or losing access to the free service.

Global Privacy Control disables marketing and personalization. Your preference is applied to browser scripts and to advertising events queued on the server. Refusal is not bypassed by sending the same advertising event through Conversions API.

Necessary

Supabase authentication cookies with a name starting sb- store your sign-in session and refresh material. The SDK sets a browser cookie lifetime up to 400 days; actual access-token validity, server session settings, logout and revocation can shorten access. PKCE verifier cookies are temporary parts of the requested sign-in flow.

pt-consent is a signed, HTTP-only first-party cookie that records your category choices for 180 days. The corresponding receipt stores the category choices, version, timestamps and expiry. It does not require a marketing or analytics identifier.

pt-intent in session storage remembers the action you requested before sign-in, such as saving or upvoting; the application ignores intents older than 30 minutes. Administration and essential form flows may use local state to keep the interface usable. Necessary security processing includes rate limiting and fraud prevention.

Analytics

Only with analytics consent, pt-sid in session storage identifies the browsing tab for first-party session analytics and is removed when the tab ends or the preference is withdrawn. Daily rotating pseudonymous visitor hashes are computed server-side; they are not described as anonymous cookies.

Without analytics consent, the new measurement path stores hourly aggregate counts without persistent visitor identifiers, session IDs or full referrer URLs. It cannot identify a unique person across pages. These aggregates are separate from consented visitor/session analytics and externally delivered campaign measurements.

Marketing

When configured and consented, Meta Pixel loads fbevents.js from Meta and can set _fbp and _fbc. They support browser matching and advertising click attribution; standard lifetimes can extend up to 90 days. Meta may use additional technology on its own domains subject to its policies and browser controls.

Conversions API sends the matching event on the server only with an active marketing receipt. It uses the same event name and ID as the browser event. SHA256-hashed email and other matching data are still personal data. New event payloads are removed from Pulltip’s queue after seven days.

Withdrawing marketing consent revokes the pixel consent state, stops new advertising events, clears accessible first-party Meta cookies and suppresses pending server events. It does not delete events already received by Meta or guarantee deletion of third-party cookies outside Pulltip’s control.

Personalization and referrals

With personalization enabled, pt-adbar-hidden in local storage can remember that you hid an optional announcement. It lasts until reset or the browser storage is cleared. Optional personalization is not required for sign-in or listing submission.

A referral code explicitly supplied during registration is validated for the requested partner program and stored with the resulting account attribution. No advertising cookie is created merely because a URL contains ref=. If you navigate away without supplying the code at registration, a persistent cross-site attribution is not inferred.

Managing storage

Use Cookie settings in the footer to change categories. You can also delete or block cookies in your browser; blocking necessary sign-in cookies can prevent account features from working. Privacy requests and questions can be sent to info@pulltip.com.

This inventory reflects Pulltip’s implementation. Hosting, security and payment providers may use additional necessary technologies when you interact with their services. Provider behavior and contractual retention details should be checked in the final legal review.