01The short version
We set no cookies at all until you log in, and the ones we then set exist only to keep your session and remember the business and view you chose. There is no advertising network, no social pixel, no session-replay tool, and no third-party analytics script on this site — including on hosted checkout pages, where your customers’ privacy is not ours to trade away.
Because we set only strictly necessary cookies, no consent banner is required under the ePrivacy Directive or the UK PECR. We consider that a feature rather than a loophole.
02Cookies we set
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
| sb-<project>-auth-token | Keeps a merchant signed in to the dashboard. Set by our authentication provider when you log in. | Strictly necessary | Session, refreshed on use |
| sb-<project>-auth-token-code-verifier | Short-lived value used to complete a secure sign-in exchange (PKCE) and prevent interception of the login flow. | Strictly necessary | Minutes, during login only |
| cp_merchant | Remembers which of your businesses the dashboard is showing, so switching businesses sticks across pages. Holds an internal business ID only. | Strictly necessary | 1 year |
| settle_mode | Remembers whether you chose to view live or test data in the dashboard. Only set when you use the Live/Test switch. | Strictly necessary (remembers your choice) | 1 year |
03Browser storage that is not a cookie
Wallet connection libraries on the checkout page, and a few dashboard preferences, use your browser’s local storage. This data stays in the browser and is never transmitted to Settle.
- wagmi.* / walletconnect.* — Remembers which wallet a customer connected so the checkout page does not prompt again on reload. Stored in the browser, never sent to us.
- settle-dashboard-sidebar, settle.tour.seen, and similar settle-prefixed keys — Dashboard preferences such as whether the sidebar is collapsed and which product tours or tips you have already seen. Stored in the browser, never sent to us.
04How we count page visits without tracking you
Merchants can see how many times a payment link was viewed. To produce that number we store a salted, irreversible hash of the visitor’s IP address together with the date — never the IP address itself — and deduplicate on it. The hash cannot be reversed to recover an address, it is not shared, and it is not used to build a profile or to follow anyone between sites.
05Controlling cookies
You can block or delete cookies in your browser settings. Blocking the authentication cookies listed above will prevent you from logging in to the dashboard, because the session cannot be maintained without them. Customers paying through a checkout link are not required to accept any cookie.
06Changes and questions
If we ever introduce a cookie that is not strictly necessary, we will update this page and request consent before setting it. Questions can go to support@settlep2p.com.