Cookie Policy
Version 2.3 — Effective June 4, 2026
1. What this policy covers
"Cookies" are small text files some websites place on your device. This policy explains the strictly necessary first-party cookies we set, the browser localStorage we use for non-sensitive UI state, and the optional analytics & advertising cookies set by Google when you grant consent — on www.tinshub.com.
We do not set non-essential cookies until you opt in. EEA/UK and all other visitors see a consent banner on first visit. You can change your choice at any time using the button below or the "Manage cookie preferences" link in the footer.
2. Storage we use
| Mechanism | Purpose | Duration |
|---|---|---|
| Strictly necessary first-party cookies | Authentication (HttpOnly, Secure, SameSite=Lax — unreadable by JavaScript), session refresh, and CSRF protection using server-validated request safeguards. | Session to 30 days |
| localStorage | Functional preferences only: theme, dismissed banners, niche profile cache, onboarding state, cookie-consent choice. No authentication secrets are stored here. | Up to 1 year (until you clear it) |
| Server-side analytics | A short allowlist of product-funnel events recorded server-side, tied to your account when logged in and anonymous otherwise. No browser identifier, tracking cookie, or pixel is set. | 90 days general; 600 days billing/checkout (see Privacy §8) |
| Analytics cookies (optional, opt-in) _ga, _ga_* | Google Analytics 4 — measures aggregate site usage so we can improve the product. Set only if you accept Analytics in the consent banner. IP is anonymized at collection. Set by Google LLC / Google Ireland Limited. | Up to 13 months |
| Advertising cookies (optional, opt-in) _gcl_au, _gcl_aw, IDE, test_cookie | Google Ads — measures the performance of ads we run on Google Search and supports conversion attribution and remarketing. Set only if you accept Advertising in the consent banner. Set by Google LLC / Google Ireland Limited and doubleclick.net. | Up to 13 months |
2a. Google Consent Mode v2
Where Google tags are used, we run them in Consent Mode v2. Defaults are denied for visitors in the EEA, UK and Switzerland — opt-in is required there, and until you accept Google receives no identifiers (only cookieless pings used for modeled statistics). Defaults are granted elsewhere — you can opt out at any time via "Manage cookie preferences" below; doing so switches the corresponding signals back to denied.
3. Lawful basis
The storage above is strictly necessary to deliver the Service you request (lawful basis: contract / legitimate interest under GDPR Art. 6(1)(b)/(f)). Because we do not set non-essential cookies, no consent banner is shown. Should that change, we will request opt-in consent before activating any non-essential storage and you will be able to withdraw consent at any time.
4. How to manage browser storage
You can block or clear cookies and localStorage via your browser settings. Clearing the strictly necessary entries above will sign you out and reset functional preferences; the app will continue to work but you will need to log in again. Most browsers also support a Do-Not-Track or Global Privacy Control signal — we do not engage in cross-site tracking, so these signals are functionally a no-op for our domain.
5. Electronic communications & marketing opt-in
By creating an account you agree to receive transactional emails required to operate the Service (verification, security alerts, billing receipts, plan changes, password resets, important policy updates, dispute correspondence). These are not marketing and cannot be opted out of while your account is active.
Product news and content tips are sent only through our optional Blog subscription, which uses double opt-in (email confirmation) and includes an unsubscribe link in every message. You can manage frequency or unsubscribe at any time via that link or by emailing support@tinshub.com.
Web push notifications are off by default and only delivered if you grant permission in your browser. You can revoke that permission at any time from your browser's site settings.
We do not send SMS marketing. We do not sell or rent your email address.
6. Third-party cookies
When you complete a payment, you are redirected to our payment processor's hosted checkout page (Stripe or Paystack), which may set cookies under its own domain and policies. We do not control those cookies. See our Sub-processors page.
7. Changes to this Cookie Policy
We may update this policy. Material changes will be announced by email and an in-app prompt requiring acceptance.