Cookies Policy

Last Updated: May 20, 2026

Axion Algo (hereinafter the Company, or "We", "Us", or "Our") uses cookies on its website to enhance your experience and for other purposes described below. By using the Website, you consent to the use of cookies as outlined in this Cookies Policy. This policy explains what cookies are, how We use them, and how they may be linked to information that identifies you. Cookies typically do not contain information that personally identifies a user; however, any personal information We collect about you may be linked to information stored in and obtained from cookies. For further details on how We process and protect personal data, please see our Axion Algo Privacy Policy. We do not store sensitive personal information (such as mailing addresses, account passwords, or payment details) in the cookies We use.

Types of Cookies We Use

Our website uses several categories of cookies, each serving a distinct purpose. We identify the type of cookie, who administers it, and why we use it as follows:

Essential (Strictly Necessary) Cookies

These cookies are Session cookies administered by Axion Algo (our domain). They are required for the website to function correctly and to provide the services you request (for example, managing login sessions or securing data). Essential cookies only identify your device and are not used to personally identify you. Because they enable basic site functions, they do not require your consent under GDPR, but we explain them here for transparency.

Performance/Analytics Cookies

These are Persistent cookies typically set by third-party analytics providers (such as Google Analytics and PostHog). They track how you use the site—for example, which pages you visit and how long you stay—to generate usage statistics. We use these cookies to count visitors and understand site performance, which helps us improve the way our website works. For instance, Google Analytics uses cookies to collect anonymous data about site usage without identifying individual users. We rely on this information to refine our services and optimize user experience.

Functionality Cookies

These are Persistent cookies administered by Axion Algo. They remember choices you make on our site (such as your preferred language or region) and enable enhanced functionality. For example, if you choose a language or theme, functionality cookies allow the site to recall those preferences on subsequent visits. This personalization improves your experience by avoiding the need to re-enter information.

Targeting/Advertising Cookies

These are Persistent cookies usually set by third parties for advertising purposes. We use them to show you ads that are more likely to be of interest based on your browsing activity. Examples include Meta (Facebook/Instagram) Ads cookies and the TikTok Pixel. These cookies track your visits across different sites (where the pixel or ad script is embedded) and build a profile of your interests. This allows us and our advertising partners to deliver relevant marketing and limit repetitive ads. As GDPR notes, marketing cookies "track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad". For instance, TikTok explains that its pixel cookies "enhance measurement accuracy and ad campaign optimization". We use these cookies only to improve and measure our advertising, and only with appropriate permissions.

Social Media Cookies

These are Persistent cookies set by social media platforms when you interact with or share content from our site (for example, using a Facebook "Like" button). They enable social sharing features and can track that you have visited this site when you are logged into social media. Social media cookies allow linking activity between our site and your social accounts. They do not serve core site functionality but can enhance your ability to share content and personalize outreach on social networks.

Third-Party Cookies and Technologies

We use the following third-party tools that set cookies on our site:

• Google Analytics – This is a web analytics service by Google. It uses cookies to collect information about how visitors use our site. Google's analytics cookies are persistent and do not personally identify you. For details on Google's use of data and cookies, see Google's Privacy Policy.
• Meta Ads (Facebook Pixel) – We use Meta's advertising tools (Facebook Pixel, Instagram Ads) to measure ad performance and target marketing. These set both first-party and third-party cookies for tracking ad interactions. See Meta's Privacy Center for more on how your data is used by Facebook/Meta.
• TikTok Pixel – We deploy TikTok's tracking pixel to measure and optimize our TikTok ad campaigns. TikTok's pixel sets cookies (first-party and third-party) to match actions on our site with TikTok users, which improves conversion measurement. For more information, see TikTok's Privacy Policy.
• PostHog Analytics – PostHog is a site analytics platform we use to understand user behavior on our website. It sets cookies (usually persistent) to record events like page views. PostHog does not track individual personal details by default. For details, see PostHog's Privacy Policy.

These third-party cookies are administered by the respective service providers, not by Axion Algo, and each tool's privacy policy governs its use of data. We encourage you to review those policies via the links above.

Interpretation and Definitions

Interpretation

The words in this Cookies Policy with initial letters capitalized have specific meanings defined in this section. These definitions apply whether those words appear in singular or in plural form.

Definitions

Company (also referred to as "We", "Us", or "Our") means Axion Algo, the operator of the Axion Algo service and Website.

Cookies means small text files that are placed on your computer, mobile device, or any other device by a website, containing details of your browsing history on that website among other uses.

Website refers to Axion Algo's website, accessible at https://axion-algo.com (including any subdomains or related domains).

User (also referred to as "You" or "Your") means the individual accessing or using the Website, or a company or other legal entity on behalf of which such individual is accessing the Website.

The Use of Cookies

We use cookies to enable core functionality of the Website, to improve site performance, to analyze how Users interact with our content, and to support our marketing and advertising efforts. Cookies can be "persistent" or "session" cookies. Persistent cookies remain on your device after you go offline or close your browser, until they expire or you delete them, whereas Session cookies are temporary and are deleted as soon as you close your web browser.

Axion Algo uses both session and persistent cookies for the purposes set out below. In the following sections, We describe the categories of cookies We use, what they do, and who administers them.

Essential Cookies

Type: Session Cookies (generally)
Administered by: Us (First-party)

Purpose: Essential cookies are necessary for the Website to function properly. They enable core features such as security, network management, and accessibility. For example, these Cookies help authenticate users, keep you logged in to your account, and prevent fraudulent use of user accounts. Without these Cookies, services you have requested (like accessing secure account areas or making use of our features) cannot be provided. We only use Essential Cookies to provide you with those services. (Note: One of these essential cookies may also be used to remember your decision regarding our cookie banner, so that your preferences are saved.)

Performance and Analytics Cookies

Type: Persistent Cookies
Administered by: Third Parties (Analytics providers)

Purpose: Performance and Analytics cookies help Us understand how visitors use the Website and how the Website is performing. These Cookies collect information about pages visited, traffic sources, time spent on pages, and other analytical data. The information collected is generally aggregated and anonymous, but in some cases it may be linked to a unique identifier associated with your browser or device. This allows Us to recognize returning visitors and gauge things like the overall number of visitors and usage patterns. We use this data to improve our Website's performance, fix errors, and enhance the content and services We offer.

For example, We use third-party analytics services such as Google Analytics and PostHog. Google Analytics (provided by Google) uses cookies to collect information about Website usage and visitor interactions; Google may receive and process this information to compile reports for us on Website activity. PostHog is an analytics platform that helps Us track User interactions within our site (such as feature usage and click paths) so that We can better understand and improve the user experience. These third-party analytics cookies are persistent and remain on your device for a set duration (determined by the provider) or until you delete them.

We may also use analytics Cookies to test new pages, features, or functionality on the Website to see how users react to them. The data from these Cookies helps Us make informed decisions about improvements and optimizations. All information collected by Performance and Analytics Cookies is used for statistical and analytical purposes and is not used to identify you personally.

Functionality Cookies

Type: Persistent Cookies
Administered by: Us (First-party)

Purpose: Functionality cookies allow the Website to remember choices you make and provide enhanced, more personalized features. These Cookies enable Us to remember your preferences and settings to improve your experience. For example, Functionality Cookies may remember your login details (so you do not have to re-enter your credentials each time), your language preference, or other customizations you have made on the Website. The purpose of these Cookies is to provide you with a smoother and more personalized experience, and to avoid you having to re-select preferences every time you visit. While not strictly necessary for the basic functioning of the site, these cookies significantly enhance convenience and site functionality. If you disable these Cookies, some of these preferences may not be saved between sessions.

Advertising Cookies

Type: Persistent Cookies
Administered by: Third Parties (Advertising networks)

Purpose: Advertising cookies (also known as targeting cookies) are used to make advertising messages more relevant to you. These Cookies track your online activity and browsing habits across the Website (and potentially other sites) in order to provide you with advertisements that are tailored to your interests. They do this by building a profile of your interests based on what content you have viewed or interacted with on our Website, which enables Us and our advertising partners to show you relevant ads on our site or on other sites you may visit.

For instance, We partner with advertising and social media platforms that use cookies or similar technologies to deliver ads and measure their effectiveness. We utilize the Meta Pixel (associated with Meta's advertising network, e.g. Facebook/Instagram Ads) and the TikTok Pixel on our Website. These tools place cookies that inform us when you interact with our ads or website, so that we can gauge ad performance and reach users with relevant content on Meta's and TikTok's platforms. Advertising Cookies may also limit the number of times you see an advertisement and help measure the effectiveness of ad campaigns. The data collected through these cookies may be shared with third-party advertisers (for example, ad networks) to enable the delivery of targeted ads on other websites.

Please note that disabling Advertising Cookies does not mean you will no longer see ads – but it will mean the ads you see are less likely to be tailored to your interests. If Advertising Cookies are disabled or not accepted, our third-party advertising partners will not collect data about your visits to our site to predict your interests.

Social Media Cookies

Type: Persistent Cookies
Administered by: Third-Parties (e.g., Facebook, Instagram, Twitter)

Purpose: These cookies enable you to share content on social media platforms. They track your interaction with our website and can link your social media accounts to your browsing behavior. These cookies help integrate social media features into our website and can be used for advertising purposes.

Third-Party Cookies

We use third-party services to understand website traffic, user behavior, and deliver personalized content, including but not limited to Google Analytics, Facebook, Instagram, TikTok, LinkedIn, and Twitter. These services may set cookies on your device when you visit our website. Each of these third-party cookies is managed by the respective provider, and we recommend reviewing their privacy policies for more information:

• Google Analytics: Google Privacy Policy
• Facebook: Facebook Privacy Policy
• Instagram: Instagram Privacy Policy
• TikTok: TikTok Privacy Policy
• LinkedIn: LinkedIn Privacy Policy
• Twitter: Twitter Privacy Policy

These third-party cookies are used to enhance your experience, understand website traffic, and show you targeted ads. However, these cookies are subject to the privacy policies of the respective service providers.

Cookie Consent Banner

When you first visit our Website, you will be presented with a cookie consent banner. This banner notifies you that We use cookies and requests your consent for non-essential cookies. By clicking "Accept" on the cookie banner (or a similar affirmative button) or by continuing to use our Website after seeing the banner, you signify your consent to our use of cookies as described in this Cookies Policy. If you do not agree to the use of certain cookies, you can choose not to click "Accept" and adjust your browser settings to refuse non-essential cookies (see the "Your Choices Regarding Cookies" section below for more on how to do this). However, please be aware that if you decline to accept cookies, some parts of the Website may not function optimally for you.

No Cookie Preference Manager (Yet): At this time, we do not utilize a granular cookie consent management platform that would allow you to customize which categories of cookies are enabled or disabled beyond the initial "accept" or "decline" choice on the banner. All Users are currently presented with a uniform cookie banner, and consent (if given) applies to all non-essential cookies as a group. We may implement a more detailed cookie consent manager in the future to provide finer control over your cookie preferences (for example, the ability to toggle specific categories like analytics or advertising cookies on/off). Should we add such a feature, we will update this Cookies Policy accordingly and make it clear to you when you visit the site.

How to Revoke Consent: If you have already consented to cookies via our banner and later decide to withdraw your consent, you can do so by deleting the cookies set by our Website using your browser's settings. Once you remove our cookies (specifically, the cookie that logs your consent decision and any other non-essential cookies), our site will generally treat you as a new visitor and the cookie consent banner may appear again, giving you the option to opt-in or refuse. You can also prevent cookies from being set in the first place by adjusting your browser preferences (again, see below for instructions for various browsers). If you need assistance or have questions about changing your consent, you can always contact us at our contact form.

Note that withdrawing consent by deleting or blocking cookies will not remove the data that was already collected by the cookies during the period you had consented. However, going forward, the cookies will no longer collect information unless you consent again. For information on how to exercise your broader data rights (such as requesting deletion of personal data) under laws like GDPR or CCPA, please refer to the section below on "GDPR and CCPA Rights" and to our Privacy Policy.

Your Choices Regarding Cookies

You have the right to decide whether to accept or reject cookies (aside from those that are strictly necessary for the Website to function). We provide several ways you can manage your cookie preferences:

• Browser Settings: Most web browsers allow you to refuse or accept cookies, as well as delete cookies that have already been set. You can typically find these controls under the "Preferences" or "Settings" section of your browser. If you set your browser to refuse cookies, please note that you may not be able to use all the features on our Website. Also, some of our pages might not display properly because certain functions rely on cookies.
• Existing Cookies: If you want to remove cookies that have already been stored on your device, you can manually delete them via your browser settings. Keep in mind that deleting cookies will remove your settings for that website (for example, you may be logged out of sessions or preferences may be lost).

For your convenience, here are links to support pages for managing and deleting cookies in some popular browsers:

• For the Google Chrome browser, see Google's instructions here: Clear, enable, and manage cookies in Chrome.
• For the Mozilla Firefox browser, see Mozilla's instructions here: Delete cookies to remove the information websites have stored on your computer.
• For the Apple Safari browser (macOS), see Apple's instructions here: Manage cookies and website data in Safari.
• For the Microsoft Edge browser, see Microsoft's instructions here: View and delete cookies in Microsoft Edge.
• If you use a different web browser, please refer to that browser's official support website for guidance on managing cookies.

Please remember that if you choose to block or delete cookies, our Website will try to respect your settings, but certain Essential Cookies may still operate since they are necessary for the site to function. Additionally, new cookies will not be set if you have blocked them, but we cannot automatically delete cookies that have already been set in the past without your action (you would need to clear them via your browser, as described above).

Also, if you use multiple browsers or devices to access our Website, you will need to ensure that each browser on each device is adjusted to suit your cookie preferences.

GDPR and CCPA – Your Data Protection Rights

Depending on where you reside, you may have certain rights under data protection laws regarding the personal information that we collect (including information collected via cookies). Axion Algo is committed to complying with applicable data protection laws, such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA, as amended by the California Privacy Rights Act, CPRA).

Your Rights under the GDPR (EU/EEA users): If you are located in the European Union, European Economic Area, or another jurisdiction with similar laws, you have the following rights with respect to your personal data:

• Right to Be Informed: You have the right to be informed about the collection and use of your personal data. This Cookies Policy and our Privacy Policy aim to provide that information.
• Right of Access: You can request confirmation of whether We are processing your personal data and request a copy of that data.
• Right to Rectification: You have the right to request that We correct any inaccuracies in your personal data or complete data that is incomplete.
• Right to Erasure: You have the right to request deletion of your personal data ("right to be forgotten"). If you withdraw consent for cookies, you can also delete cookies as described above; additionally, you may request that We erase data collected via those cookies, subject to certain exceptions (for example, We might need to retain some data for legal compliance).
• Right to Restrict Processing: You can ask Us to restrict the processing of your personal data in certain circumstances (for instance, if you contest the accuracy of the data or if the processing is unlawful but you prefer restriction over deletion).
• Right to Data Portability: You have the right to obtain the personal data you provided to Us (in a structured, commonly used, machine-readable format) and to transfer it to another controller, where technically feasible and applicable.
• Right to Object: You may object to certain processing of your data, including processing for direct marketing purposes. This means, for example, you can object to having your data used for profiling or targeted advertising via cookies. In practice, you can exercise this right by refusing Advertising Cookies as described in this policy. If you object to any processing that is based on our legitimate interests, We will evaluate your request and will no longer process the data unless We have compelling legitimate grounds to continue or if it is needed for legal claims.
• Right to Withdraw Consent: If We are processing your personal data based on your consent (including your consent to non-essential cookies), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing conducted prior to your withdrawal. For cookies, you can withdraw consent by clearing or blocking cookies as explained above, and we will cease to collect data via those cookies.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory data protection authority in your country of residence or work, or where an alleged infringement of data protection laws has taken place, if you believe Our practices violate the GDPR or other applicable law.

To exercise any of your GDPR rights, you can contact Us at our contact form. We may need to verify your identity before fulfilling certain requests, and some rights may be subject to legal exemptions or limitations under applicable law. We will respond to your request within the time frame required by law (generally within one month for GDPR requests, with the possibility of extension if the request is complex).

Your Rights under CCPA (California residents): If you are a resident of California, you are entitled to certain rights under the CCPA regarding your personal information. These include:

• Right to Know: You have the right to request that We disclose what personal information We collect, use, disclose, and sell. This includes the categories of personal information, the categories of sources, the business or commercial purpose for collecting or selling that information, the categories of third parties with whom We share the information, and specific pieces of personal information We hold about you.
• Right to Delete: You have the right to request the deletion of your personal information that We have collected from you, subject to certain exceptions. Once We receive and confirm a verifiable consumer request, We will delete (and instruct Our service providers to delete) your personal information from our records, unless an exception applies (for example, if we need to retain data for legal obligations or internal business purposes permitted by CCPA).
• Right to Opt-Out of Sale or Sharing: The CCPA gives you the right to direct a business that sells or shares personal information to third parties not to sell or share your personal information. **At this time, Axion Algo does not sell personal information** as defined under the CCPA. We also do not share personal information for cross-context behavioral advertising without consent. If in the future We engage in practices that are considered a "sale" or "sharing" of personal data (for instance, allowing certain advertising cookies might be construed as a "sale" under CCPA's broad definitions), We will provide a clear method for you to opt out (such as a "Do Not Sell or Share My Personal Information" link on our Website). We will also honor any legally recognized browser signals for opt-out (like the Global Privacy Control) if required by law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means, for example, we will not deny you services, charge you a different price, or provide a different level of quality of service just because you exercised your rights under the CCPA. However, please note that if the exercise of your rights limits our ability to process personal information (such as a request to delete all of your data), we may not be able to provide you with certain services that rely on that data.

If you are a California resident and wish to exercise any of these rights, please contact Us at our contact form. To process your request, We will take steps to verify your identity to ensure that the person making the request is actually you (or an authorized representative). The CCPA also allows you to designate an authorized agent to make these requests on your behalf, but the agent must provide proof of their authorization and we may still require you to verify your identity directly with Us.

For more detailed information about our data practices and your rights, please refer to our Privacy Policy. That document includes comprehensive disclosures about what data We collect, how We use it, and how you can exercise control over your personal information. This Cookies Policy is intended to complement our Privacy Policy by specifically addressing our use of cookies and related technologies.

Specific Cookies We Set (Reference Table)

The list below describes the cookies that may be set on your device when you use our Website. Names and durations may vary slightly as third-party providers update their products; we make best efforts to keep this list accurate.

• __supabase-auth-token / sb-*-auth-token — first-party, essential. Stores your authenticated session with our database provider. Duration: session or up to 7 days.
• _csrfSecret — first-party, essential. Stores a random secret used to issue and verify CSRF tokens on form submissions. Duration: session.
• cookie-consent — first-party, essential. Remembers whether you accepted or rejected non-essential cookies. Duration: 12 months.
• theme — first-party, functional. Remembers your light/dark theme choice. Duration: 12 months.
• axion_referrer / axion_ref — first-party, functional. Stores the affiliate code (if any) that referred you to the site so we can attribute commissions correctly. Duration: 60 days.
• ph_*_posthog — first-party, analytics (PostHog). Stores a pseudonymous user ID and event queue for product analytics. Duration: 12 months.
• _ga, _ga_*, _gid, _gat — third-party, analytics (Google Analytics 4). Used to distinguish users and throttle request rate. Duration: up to 24 months.
• _fbp, fr — third-party, advertising (Meta Pixel). Used to deliver and measure ads on Meta platforms. Duration: 90 days for _fbp; up to 90 days for fr.
• _ttp — third-party, advertising (TikTok Pixel). Used to measure ads and create custom audiences on TikTok. Duration: up to 13 months.
• __stripe_mid, __stripe_sid — third-party, essential (only on checkout and billing pages). Used by Stripe for fraud prevention and to identify the device making a payment. Duration: 1 year (mid) / 30 minutes (sid).
• cf_clearance, __cf_bm — third-party, essential (Cloudflare). Used to challenge bot traffic and prevent abuse. Duration: 30 minutes to 30 days.

We may also use local storage and session storage (not technically cookies, but similar) to persist UI preferences and limited cached data. We do not use device fingerprinting techniques designed to re-identify you across sessions when cookies are blocked, beyond the basic anti-fraud signals collected by Stripe and Cloudflare.

Web Beacons, Pixels & Embedded Content

Our Website and emails may include small graphic images called “web beacons” or “pixel tags” that allow us and our analytics providers to record events such as page views, ad conversions and email opens. Pages that embed third-party content — for instance the TradingView chart on the homepage, embedded YouTube tutorials, or a Twitter card — may also set their own cookies under the third-party's privacy policy when you interact with that content. We have no control over cookies set by embedded third-party content; consult the embed provider's cookie policy for details.

Do Not Track (DNT) & Global Privacy Control (GPC)

Most browsers offer a “Do Not Track” setting. There is currently no industry standard for how websites should respond to DNT signals, and we therefore do not respond to DNT specifically. However, where required by law (e.g., California CPRA, Colorado CPA) we honour the W3C's Global Privacy Control (GPC) signal as an opt-out from sale and from cross-context behavioural advertising. If we detect a GPC header from your browser we will treat your visit as an opt-out of those activities for the duration of the session and any subsequent sessions linked to the same device profile.

Cross-Device & Cross-Context Tracking

We do not perform deterministic cross-device tracking (e.g., linking your work laptop and your phone through a shared identifier) beyond what occurs naturally when you log in on multiple devices with the same account. Some third-party advertising tools (Meta, TikTok) may attempt probabilistic cross-device matching using hashed signals derived from your activity; this only happens if you have accepted marketing cookies and is governed by the third-party platform's own privacy policy.

Cookies in Mobile Apps & PWA Mode

If you install our Website as a Progressive Web App (PWA) on your mobile device, cookie behaviour is similar to a regular browser session. We do not currently distribute a native mobile app. If we publish one in the future, that app may use platform-specific identifiers (e.g., Apple IDFA, Google AAID) subject to your operating system's tracking-transparency settings — we will update this Policy and prompt you for consent before activating any such identifier.

Comprehensive Per-Cookie Reference Table

The table below enumerates the individual cookies, browser storage keys, and similar local identifiers that Axion Algo, its sub-processors, or its embedded third parties may write to your device when you interact with the Website. We classify each entry by the categories defined earlier in this Policy: Strictly Necessary, Performance, Functionality, and Marketing. Some entries are reserved for vendors we are not currently using; they are listed because they appear in our consent registry and may be activated in the future. If a row is marked "not in use," we have not enabled the corresponding integration as of the "Last Updated" date shown at the top of this Policy. We regenerate this table whenever our consent platform completes a full domain crawl, which occurs at least once per calendar quarter and after every release that touches the consent or analytics stack.

Cookie durations are stated as configured by the vendor and may be shortened by your browser's privacy mode. For example, Safari with Intelligent Tracking Prevention (ITP) caps script-set first-party cookies at seven days, regardless of theMax-Age attribute we set on the server. Where a row describes a non-cookie technology (such as localStorageor IndexedDB), the "type" column reflects that distinction so you can locate and clear the value through your browser's developer tools.

Per-Vendor Deep Dive

The following section describes each third-party service that currently sets, or could plausibly set, cookies or other browser storage when you interact with Axion Algo. For every vendor we explain (i) the purpose served, (ii) the categories of personal data we share with the vendor, (iii) the opt-out mechanism, and (iv) the vendor's own privacy policy URL. Where a vendor is listed but not currently enabled, that fact is stated explicitly.

Supabase

Purpose: authentication, database, file storage, and realtime sockets. Supabase is the core platform on which Axion Algo's account system is built; it is a Strictly Necessary sub-processor and cannot be disabled while you remain a logged-in user. Data shared: account identifiers, hashed passwords (never the plaintext), session tokens, profile data you enter, and any data your trading workspaces produce.Hosting: EU (Frankfurt) for European customers and US for North-American customers, per our regional residency policy. Opt-out: deleting your Axion Algo account terminates all Supabase storage of your data within thirty days.Privacy policy: supabase.com/privacy.

Stripe

Purpose: payment processing, fraud prevention, invoicing, customer billing portal, and tax calculation. Stripe is a Strictly Necessary sub-processor for any paid feature.Data shared: billing email, country, postal code when applicable, the tokenised card or wallet handle, the items you are purchasing, your IP address (used by Stripe Radar to detect fraud), and Stripe-specific cookies described in the table above. We never see or store your raw card number, CVC, or expiry. Opt-out: you can cancel subscriptions from the billing portal; closing your account terminates Stripe retention beyond legal record-keeping minima (typically seven years for financial records). Privacy policy: stripe.com/privacy.

Cloudflare

Purpose: CDN edge delivery, TLS termination, bot management, DDoS mitigation, and DNS. Cloudflare sits in front of every request to axion-algo.com.Data shared: IP address, User-Agent, request path, TLS fingerprint, and the cookies cf_clearance,__cf_bm, and cf_chl_* when challenges are issued. Opt-out: Strictly Necessary; cannot be disabled without losing access to the site. Privacy policy: cloudflare.com/privacypolicy.

PostHog

Purpose: product analytics, funnel analysis, feature flags, and session replay (replay is disabled by default and enabled per-account only with explicit consent).Hosting: European Union region (eu.posthog.com). Data shared: a pseudonymous distinct ID, event names, properties you do not consider personal, page URLs, and the cookies described in the table above. We do not forward IP addresses in cleartext: PostHog truncates the last octet before storage. Opt-out:decline Performance cookies in the consent banner; PostHog will be initialised in opt-out mode and emit no events.Privacy policy: posthog.com/privacy.

Sentry

Purpose: exception tracking, performance monitoring, and source-map symbolication. Sentry runs in our browser bundle in "errors-only" mode for users who have not accepted Performance cookies, capturing only stack traces and the page URL at the moment of an unhandled error.Data shared: error message, stack trace, browser version, OS, and a per-session trace ID. We do not send form inputs, URLs containing access tokens, or contents oflocalStorage. Opt-out: decline Performance cookies; only crash reports remain (we treat those as Strictly Necessary because they are the primary mechanism by which we discover security regressions).Privacy policy: sentry.io/privacy.

Resend

Purpose: transactional and marketing email delivery. Resend does not set cookies on our Website directly, but emails sent through Resend embed a 1×1 tracking pixel and click-tracking redirects when those features are enabled.Data shared: recipient email, message metadata, and email-engagement events. Opt-out: click "unsubscribe" in any marketing email or set your account notification preferences to "transactional only."Privacy policy: resend.com/legal/privacy-policy.

Discord

Purpose: community widget and invitation links on select marketing pages. When you interact with an embedded Discord component, Discord may set its own cookies inside the iframe.Data shared: any data the Discord widget collects per its own policy; Axion Algo has no access to that data.Opt-out: do not interact with the embedded widget; browser-level third-party cookie blocking will prevent most Discord cookies from being set.Privacy policy: discord.com/privacy.

Vercel / Hetzner

Purpose: infrastructure hosting. Static assets and the marketing site are served from Vercel's edge network; the primary application backend runs on a Hetzner VPS in Helsinki, Finland. Neither provider sets cookies in your browser on our behalf, but their request logs include your IP address and User- Agent for the purposes of capacity planning and abuse mitigation.Privacy policies: vercel.com/legal/privacy-policy and hetzner.com/legal/privacy-policy.

Reserved future vendors (not currently enabled)

The following vendors appear in our consent registry but are not active as of the "Last Updated" date: Google Analytics 4, Google Tag Manager, Google Ads, Meta Pixel + Conversions API, TikTok Pixel, HubSpot, Thrive Leads, LinkedIn Insight Tag, and X (Twitter) Universal Website Tag. If we activate any of them we will (a) update this Policy, (b) raise the version stored inaxion_consent_version so the banner reappears, and (c) wait for renewed consent before loading the corresponding script.

Local Storage, Session Storage & IndexedDB

Although strictly speaking they are not cookies, modern browsers offer several other client-side storage APIs that we use to persist small amounts of data. Each of them is scoped to the origin (https://axion-algo.com) and is invisible to third-party domains. The keys we write are listed in the per- cookie reference table above; this section summarises what each storage tier does and how you can clear it.

localStorage is persistent until you explicitly clear it through your browser's site-data settings. We use it for non-sensitive UI preferences such as panel sizes (axion_ui_state), default chart settings (axion_chart_prefs), and a list of dismissed announcement banners (axion_seen_banners). Because these values are not transmitted to our server with every request, storing them client-side reduces network traffic and avoids growing the cookie header beyond practical limits.

sessionStorage is scoped to a single browser tab and is cleared automatically when the tab is closed. We use it for ephemeral state that should not survive across tabs, such as a temporary form draft (axion_form_draft) or a per- tab CSRF nonce (axion_csrf_nonce).

IndexedDB is a structured-document database provided by the browser. The only IndexedDB usage on our domain comes from third-party scripts: Stripe writes anonymised performance metrics to its own IndexedDB database scoped to its checkout iframe, and PostHog uses IndexedDB as a fall-back queue when localStorage is unavailable (e.g., in some private-browsing modes).

You can inspect, export, and delete any of the above storage tiers through your browser's developer tools (Application tab in Chromium, Storage tab in Firefox, Storage tab in Safari). Clearing site data for axion-algo.com removes every cookie, localStorage entry,sessionStorage entry, IndexedDB database, and Cache Storage entry associated with our origin.

Web Beacons & Tracking Pixels

A "web beacon" (also called a pixel tag, clear GIF, or tracking pixel) is a tiny graphic embedded in a web page or email. When the graphic loads, the request to the hosting server produces a log entry that can be associated with cookies or other identifiers passed along with the request. We use a small number of beacons and pixels in clearly delimited contexts.

Email-open beacons: Marketing emails sent through Resend may contain a 1×1 transparent PNG whose URL encodes the recipient's campaign ID. When your email client downloads images, we learn that the email was opened. Modern privacy features (Apple Mail Privacy Protection, image-blocking in Outlook) preload images via a proxy or block them entirely, which is fine by us: open rates are an aggregate diagnostic, not a basis for individual targeting. Transactional emails (password resets, invoices, security alerts) never contain tracking pixels.

Server-side conversion APIs: Where we run paid advertising campaigns we may transmit conversion events directly from our backend to the advertising platform via a server-to- server API (Meta's Conversions API, Google's Enhanced Conversions, TikTok's Events API). This approach reduces our reliance on browser pixels but is functionally equivalent for privacy purposes: it still discloses a hashed identifier and a conversion event to the advertising platform. We only send these events for users who have accepted Marketing cookies, and we hash email addresses with SHA-256 before transmission.

How to opt out: declining Marketing cookies in the consent banner disables both the browser pixels and the server-side conversion APIs for your account. You can also disable remote image loading in your email client to defeat email-open beacons globally.

HTML5 Storage & Flash Cookies (LSO)

Adobe Flash Player was deprecated in 2020 and is no longer supported by any major browser. Axion Algo does not, and never has, used Flash Local Shared Objects (LSOs, sometimes called "Flash cookies") for any purpose. All of our client- side state is held in HTML5 storage APIs, as described in the Local Storage section above.

ETag & Cache-Based Tracking

An ETag is an HTTP response header used by browsers to validate cached resources. In principle, a server can issue a unique ETag to each visitor and use theIf-None-Match header that the browser later sends to re-identify them without setting a cookie. This technique is sometimes called "ETag tracking" or "cache tracking," and it is widely regarded as a privacy anti-pattern. We do not engage in ETag tracking. TheETag values that our CDN attaches to static assets are derived from the file hash and are identical for every visitor.

HSTS Supercookies

HTTP Strict Transport Security (HSTS) is a security mechanism that instructs browsers to communicate with our domain only over TLS. Because the browser must remember the HSTS directive across sessions, researchers have demonstrated that it is theoretically possible to encode a small identifier across many subdomains using HSTS preferences, creating a "supercookie" that cannot be cleared through normal cookie management. We do not employ HSTS supercookies. We use a single HSTS policy applied to the apex domain and the wwwsubdomain, with the includeSubDomains andpreload directives set so thataxion-algo.com can be added to the Chrome HSTS preload list. The preload submission is publicly verifiable at hstspreload.org.

Server-Side & First-Party Analytics

Wherever feasible we prefer first-party, server-side analytics over client-side third-party trackers. Our PostHog deployment is addressed through a CNAME on our own domain, which means events appear to the browser as a first-party request and avoid the third-party-cookie restrictions imposed by Safari ITP and Firefox ETP. Server-side analytics also let us strip personal identifiers (such as IP addresses) before the data reaches the analytics provider, which we consider more GDPR-friendly than the standard client-side beacon model.

Consent String Standards (IAB TCF, GPP)

The IAB Europe Transparency & Consent Framework (TCF) v2.2 and the IAB Tech Lab's Global Privacy Platform (GPP) define machine-readable formats in which a website can encode the user's consent choices for downstream ad-tech vendors. Axion Algo does not currently emit TCF or GPP consent strings because we do not participate in real-time bidding or programmatic advertising ecosystems. We use a custom, internal consent solution: theaxion_consent cookie described above stores a JSON document of category-level choices. If we later integrate with any vendor that requires a TCF string, we will deploy a certified Consent Management Platform (CMP) and migrate existing consents into a TCF-equivalent representation before the new vendor is activated.

Per-Browser Opt-Out Mechanisms

Every modern browser ships with built-in tools to control cookies, third-party trackers, and other forms of cross-site storage. The following overview is provided for convenience; the most up-to-date instructions are always on the browser vendor's own support site.

• Google Chrome: Settings → Privacy and security → Third-party cookies. Chrome offers "Block third-party cookies" as a one-click toggle and exposes per-site overrides under the "Site settings" menu. Chrome's Privacy Sandbox APIs (Topics, Protected Audience, Attribution Reporting) can also be configured from the same screen.
• Apple Safari: Safari → Settings → Privacy. Safari enables Intelligent Tracking Prevention (ITP) by default, which caps script-set first-party cookies at seven days and blocks most third-party cookies outright. ITP is enabled even in non-private browsing windows and cannot be disabled on iOS Safari.
• Mozilla Firefox: Settings → Privacy & Security → Enhanced Tracking Protection (ETP). The Strict preset blocks known cross-site trackers, third-party tracking cookies, social-media trackers, fingerprinters, and cryptominers. Firefox also offers a "Total Cookie Protection" setting that isolates cookies per first-party domain.
• Microsoft Edge: Settings → Cookies and site permissions. Edge mirrors Chromium's controls and adds a separate "Tracking prevention" pane with Basic, Balanced, and Strict modes.
• Brave: Settings → Shields. Brave Shields blocks third-party cookies, fingerprinting, and known ad and tracker networks by default. The Shields icon in the address bar lets you toggle protection per site.
• Opera: Settings → Advanced → Privacy & security → Cookies and other site data. Opera shares most of its cookie-management UI with other Chromium browsers and includes a built-in tracker blocker.
• DuckDuckGo Privacy Browser: blocks third- party trackers and forces HTTPS connections; cookie controls mirror the underlying WebKit/Chromium engine.

Mobile Device Identifiers (IDFA, AAID)

Apple's Identifier for Advertisers (IDFA) and Google's Android Advertising ID (AAID) are device-level identifiers exposed only to native mobile apps, not to mobile browsers. Axion Algo does not currently distribute a native mobile app, so neither identifier is collected by us. If you browse our Website on a mobile device, the browser sandbox prevents any script we load from accessing the IDFA or AAID.

Apple App Tracking Transparency (ATT)

Apple's App Tracking Transparency framework requires native iOS apps to obtain explicit user permission before tracking them across other companies' apps and websites. Because Axion Algo has no iOS application as of the "Last Updated" date, the ATT prompt does not apply to our services. If we ship an iOS app in the future, we will integrate the ATT API and request permission only when strictly necessary.

Privacy Sandbox & the Topics API

Google's Privacy Sandbox is a set of browser-native APIs intended to replace third-party cookies for advertising purposes. The Topics API derives a short list of interest categories from your browsing history, locally on your device, and exposes them to participating sites. Other Sandbox APIs include Protected Audience (formerly FLEDGE) for remarketing and Attribution Reporting for conversion measurement.

Axion Algo does not currently integrate any Privacy Sandbox API. We monitor the evolving specifications and may revisit this position if the APIs become a practical alternative to cookie-based attribution. Any future integration will be announced in this Policy and gated behind explicit consent.

Cross-Domain Tracking Limitations

Browsers with aggressive third-party cookie restrictions (Safari with ITP, Firefox with ETP Strict, Brave with Shields, and Chrome once third-party cookies are fully phased out) may break flows that historically depended on third-party cookies. The practical consequences for our users are:

• Stripe Checkout falls back to a first-party iframe with redirect-based fraud signals. Payments succeed but Stripe may show an extra security challenge.
• Discord widget embeds may fail to load member counts and online status, displaying a static placeholder instead.
• Embedded social media content (e.g., X posts) may render as a static card without interaction analytics being delivered to the originating platform.
• Cross-device conversion attribution in any future advertising integration will rely on hashed-email server-side matching rather than third-party cookies.

Re-Identification Risk & Fingerprinting

Browser fingerprinting is the practice of combining passive signals (User-Agent string, list of installed fonts, screen resolution, language preferences, time zone, WebGL parameters) to produce a quasi-unique identifier that survives cookie clearing. Axion Algo does not engage in active fingerprinting for advertising or analytics purposes. The cookies and identifiers we set are first-party and clearable. We acknowledge that some passive entropy is unavoidable: any HTTP request discloses your IP address, User-Agent, and language headers, and any JavaScript-capable browser is forced to expose enough APIs for a fingerprint to be assembled by a determined actor.

Two of our sub-processors collect fingerprint-grade signals for narrowly defined Strictly Necessary purposes: Stripe Radar uses device fingerprinting to score payment fraud, and Cloudflare Bot Management uses TLS and HTTP fingerprinting to distinguish humans from automated scripts. Both uses are limited to fraud and abuse prevention and cannot be disabled without exposing the platform to substantial risk.

Cookie Expiration Summary

Many users only want to know which cookies persist the longest. The following table summarises the most-persistent cookies and storage entries we may write, sorted from longest to shortest duration.

Withdrawing or Modifying Your Consent

Consent is never permanent. You can withdraw or modify it at any time through the "Cookie Settings" link in the footer of every page. Clicking that link reopens the consent banner with granular controls so you can toggle each non-essential category (Performance, Functionality, Marketing) independently. Your updated choices take effect immediately for new page loads; scripts already loaded in the current tab are not retroactively deleted, but they are blocked from sending further data and are unloaded on the next navigation.

We retain the consent audit log for six years from the date of the most recent consent event, in order to satisfy GDPR Article 7(1) (controller's burden to demonstrate that consent was obtained) and the statute-of-limitations period for most regulatory enforcement actions in the European Union. After six years the entry is purged automatically.

Geographic Gating of the Cookie Banner

The cookie banner is not displayed identically to every visitor. We infer your jurisdiction from your IP address (via Cloudflare's edge geolocation, which we treat as a Strictly Necessary processing operation) and render the variant best matched to your local legal regime.

• European Economic Area (EU 27 member states, Iceland, Liechtenstein, Norway), United Kingdom, and Switzerland:banner shown on first visit with three buttons: "Accept all," "Reject all," and "Manage preferences." Pre-ticked boxes are never used; no non-essential cookies are set until consent is given. This is the GDPR / UK GDPR / Swiss FADP baseline.
• California (and other US states with comprehensive privacy laws such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and Delaware): banner shown with a "Do Not Sell or Share My Personal Information" link and a clear notice of any opt-out rights under the applicable statute. We also honour the Global Privacy Control (GPC) signal as a legally binding opt-out where required.
• Brazil (LGPD): banner equivalent to the EEA variant, with a Portuguese-language fallback when your browser requests it.
• Canada (PIPEDA, Quebec Law 25): banner shown with explicit, granular controls for non-essential cookies; Quebec residents see additional disclosures regarding cross- border data transfers required by Law 25.
• Other regions: no consent banner is required by default, but the "Cookie Settings" link in the footer always reopens the preference centre on demand.

Cookie Consent Audit Log

Every consent event you generate produces a row in our audit log with the following fields:

• Consent ID: opaque UUID written to theaxion_consent_id cookie.
• Timestamp: UTC time of the click, with millisecond precision.
• Hashed IP address: we apply SHA-256 with a rotating server-side salt to your IP. We retain only the hash, never the cleartext IP.
• Categories accepted: the boolean state of each non-essential category (Performance, Functionality, Marketing) at the moment of submission.
• Consent version: the integer revision of the consent banner text in force at the time.
• Banner variant: the geographic gating variant rendered (EEA, California, LGPD, etc.).
• Browser fingerprint hash: a non-identifying hash of the User-Agent string used solely to detect tampering with consent records.

On request, we can supply you with a copy of every consent record associated with your Consent ID. Send the request to our contact form together with the value of your axion_consent_idcookie (visible in your browser's developer tools).

First-Party vs Third-Party Cookies

A first-party cookie is set by the domain in your browser's address bar; in our case, that means a cookie whose Domain attribute isaxion-algo.com or a subdomain thereof. A third-party cookie is set by a different domain loaded inside the page (for example, an embedded Stripe iframe setting cookies on stripe.com). The vast majority of cookies we set are first-party: every axion_*cookie, the Supabase auth cookies (because Supabase is addressed via a subdomain CNAME), the PostHog analytics cookies (also via CNAME), and the Cloudflare cookies. The third-party cookies you may encounter come from Stripe (during checkout), Discord (in community widgets), and the reserved-but-not-currently-enabled advertising vendors listed earlier.

Session Cookies vs Persistent Cookies

A session cookie has no Expires orMax-Age attribute; it is deleted automatically when the browser is fully closed. A persistent cookiehas an explicit expiry and survives across browser restarts until that expiry is reached or the user clears it. Session cookies in our deployment include the Supabase access token (sb-access-token), the CSRF secret (_csrfSecret), the in-tab session identifier (axion_session), and the Stripe per-checkout cookie (__stripe_sid). All other cookies in the reference table are persistent.

Performance Impact of Cookies

We have engineered our cookie usage to minimise its impact on page-load performance. The consent banner module adds approximately ten kilobytes (compressed, gzip) to the initial JavaScript bundle and is loaded asynchronously, so it does not block the first paint of the page. Analytics events are batched on the client and sent in a single request every fifteen seconds, or immediately on page unload via thenavigator.sendBeacon() API. The total volume of cookie data attached to each HTTP request is typically under four kilobytes, well below the per-domain limit imposed by browsers (commonly 8 KB). Should that limit ever be approached, we shift state to localStorage rather than continuing to enlarge the cookie header.

Cookies & Children

Axion Algo is not directed to children and is not intended for users under the age of eighteen. We do not knowingly collect personal data from, or set tracking cookies for, individuals we know to be under thirteen years of age (the threshold set by the Children's Online Privacy Protection Act in the United States), nor under sixteen (the default threshold under GDPR Article 8 in many EEA member states). If you become aware that a child has provided us with personal information or has otherwise generated tracking data on our Website, please contact our contact form and we will delete the relevant cookies, account data, and audit log entries.

Updates to this Cookies Policy

We may update this Cookies Policy from time to time to reflect changes in technology, legal requirements, or our business operations. If We make material changes to the way We use cookies, We will update the "Last Updated" date at the top of this policy and, if required by law, provide notice to you (for example, by posting a notice on our Website or via a pop-up banner). We encourage you to review this Cookies Policy periodically to stay informed about our use of cookies and related technologies. Your continued use of the Website after any updates or revisions to this policy are posted will signify your acceptance of those changes, to the extent permitted by law.

Contact Us

If you have any questions or concerns about this Cookies Policy or how Axion Algo uses cookies and processes your data, please feel free to contact us. You can reach us by email at our contact form.

For general information about how we handle personal data (beyond cookies), please refer to our Privacy Policy. For questions specifically about privacy or data protection, you may also contact our support email above. We value your privacy and will gladly address any questions or feedback you have.

Cookie-specific questions, audit-log copy requests, and consent-record corrections should be directed to our dedicated privacy mailbox at our contact form. We aim to respond to cookie enquiries within five business days and to formal data-subject requests within the statutory deadlines (typically one month under GDPR Article 12(3), forty-five days under the CCPA, with extensions where the request is complex).

Material changes to this Cookies Policy — for example, the addition of a new third-party tracking vendor, the introduction of a new cookie category, or a substantive change to the way we process consent — will be announced at least thirty days before they take effect, via an in-app notification and via the consent banner reappearing in its updated form. Minor edits (typographical corrections, clarifications that do not alter the substance of our processing, link maintenance) take effect on posting and are reflected in the "Last Updated" date at the top of the Policy. A full version history is available on request.