Last updated: 3 November 2026
This policy applies only to the Localz web app. The iOS and Android apps do not use cookies — they sign you in with a secure token stored on your phone (the Keychain on iPhone, encrypted app storage on Android).
Localz sets only first-party cookies — our own, on localz.chat. We do not use advertising cookies, analytics services such as Google Analytics, or any third-party tracking cookies.
The web app uses Auth.js (NextAuth v5) for signing in, which sets the cookies in the first four rows below (the fourth only while you sign in with Google or Apple). The other two remember what you were doing when a link brought you here, so it survives signing up:
| Cookie | Purpose | Duration |
|---|---|---|
__Secure-authjs.session-token | Keeps you logged in. Contains your encrypted session (JWT). Set as httpOnly — JavaScript cannot read it. | Until you log out or session expires |
__Host-authjs.csrf-token | Protects against Cross-Site Request Forgery attacks. Required for all form submissions. | Session |
__Secure-authjs.callback-url | Remembers where to redirect you after login. | Session |
__Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | Set only while you sign in with Google or Apple, to check that the reply really comes from them. Deleted once you are signed in. | 15 minutes at most |
localz_pledge_intent | Set only if you follow a link asking you to help open a city while logged out. Remembers which one, so it survives the sign-up and email-verification steps, then is cleared once you land in the app. | 30 days (or until used) |
localz_join_intent | Set only if you follow an event or topic link while logged out. Remembers which one, so you land in it once you have signed up, then is cleared. | 7 days (or until used) |
The web app also keeps a few things in your browser's local storage — for example your theme, cards and hints you have dismissed, whether you have seen the welcome tour, and which topics and questions this browser has already shown you, so Home can put new things first. They are there only to make the app work the way you left it. Most stay on your device; the list of what this browser has shown you may be sent with a request so For you can order itself, and is not stored by us.
The sign-in cookies and the two link cookies are strictly necessary for something you asked for — staying signed in, or getting to the event, topic or city you followed a link to — so under the UK's Privacy and Electronic Communications Regulations (PECR) they do not need your consent.
If you arrive through one of our campaign links (for example a poster or a social media post), the campaign's name is part of the link's address. We read it from there, and if you sign up in that visit we store the campaign name on your account so we know which campaigns bring people in. Nothing is stored on your device for this.
If we ever add non-essential cookies in the future, we will update this policy and add a consent mechanism before doing so.
You can control cookies through your browser settings. Note that deleting or blocking Localz's cookies will log you out and you will need to sign in again each visit.
Bupbokmuk Lab Ltd
71-75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Email: admin@localz.chat
Company number: 17292473
ICO Registration: ZC191440
© 2026 Bupbokmuk Lab Ltd. All rights reserved.