Last updated: September 22, 2026
This Cookies Policy explains what cookies and similar technologies iswap.pk ("we", "us", "our"), operated by ISWAP SMC (PVT) LIMITED, uses on the website and mobile applications (the "Platform"); why we use each one; how long it lasts; and how you can accept, decline, or change your choice at any time. It should be read together with our Privacy Policy, which governs our use of personal information more broadly, and our Terms & Conditions.
A cookie is a small text file that a website stores in your browser. It lets the site remember information about your visit — such as whether you're signed in, or a preference you set — the next time you load a page or return to the site. "Similar technologies" covers things that work the same way for this purpose, such as your browser's local storage (used to remember your cookie choice itself, described in Section 4).
A device/browser fingerprint is not a cookie, and is not covered by this policy. It works differently and is addressed separately — see Section 8 below and Section 5 of our Privacy Policy.
When you first visit the Platform, a banner at the bottom of the page asks you to choose "Accept All" or "Necessary Only." That choice is your consent (or refusal of consent) to the optional cookies described in this Policy — strictly necessary cookies are used either way, since the Platform cannot function without them.
We group cookies into four categories. The tables in Sections 5 through 7 list the specific cookies in each.
We do not currently use analytics or advertising cookies that require your consent. Section 9 explains the two measurement tools we do use and why neither sets one. If that changes — for example, if we add a cookie-based analytics or advertising provider in the future — the "Accept All" / "Necessary Only" choice in our consent banner will control that provider's cookies too, and we'll update this Policy first.
Set by iswap.pk itself. These keep you signed in and keep the Google sign-in flow secure; they cannot be disabled through our consent banner, though you can block them yourself through your browser at the cost of being signed out on every visit.
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| authjs.session-token (or __Secure-authjs.session-token) | Keeps you signed in as you move between pages. | iswap.pk | Up to 30 days, or until you sign out |
| authjs.csrf-token | Protects the sign-in form against cross-site request forgery. | iswap.pk | Session |
| authjs.callback-url | Remembers where to send you back to after signing in. | iswap.pk | Session |
| iswap-pending-google-link | Temporarily holds a verified Google identity while you confirm linking it to an existing password account. | iswap.pk | 10 minutes |
| iswap-google-link-intent | Confirms it's really you connecting a Google account from My Account settings, not someone else's Google sign-in. | iswap.pk | 10 minutes |
| iswap-pending-visitor-id | Carries the fraud-prevention device signal described in Section 5 of our Privacy Policy across the brief redirect to Google and back during sign-in — see below for why this is needed. | iswap.pk | 10 minutes |
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| iswap_cookie_consent | Remembers the choice you make in our cookie banner, so we don't ask again on every visit. | iswap.pk (stored in your browser's local storage, not a cookie) | Until you clear your browser data or change your choice |
Security & Fraud Prevention
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| _GRECAPTCHA and related reCAPTCHA cookies | Distinguishes real visitors from bots and scripts on forms we protect (sign-up, sign-in, posting a listing). | Google reCAPTCHA | Set and controlled by Google — see Google's Cookie Policy |
Sign-In
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| Google account/session cookies (e.g. under accounts.google.com) | Google's own cookies, set only if you choose to sign in with Google or Google One Tap, so Google can complete that sign-in. | Set and controlled by Google |
These are set by Google, not by us, and are governed by Google's Cookie Policy. We only receive the result of the sign-in or the fraud check — we don't have access to, and can't control, the cookies Google itself sets on your device.
Separately from the cookies on this page, we also use a device/browser fingerprint and record your IP address for fraud prevention — for example, to detect a device linked to a previously banned account. This is a different technique: it isn't stored in your browser and can't be cleared by deleting cookies, because nothing is stored there to delete — it is computed fresh from your device's characteristics each time. Full detail on how it works, when it's used, and your rights over it is in Section 5 of our Privacy Policy, not this Cookies Policy — we call it out here only so the two aren't confused with each other.
The Platform may in the future display advertising served by third-party vendors, including Google, which would use their own cookies (such as the DoubleClick/DART cookie) to serve ads based on your browsing activity. If and when that is active, it will be listed in this Policy with its own entry, and will only load after you choose "Accept All" in the consent banner — it is not active today. Full detail on advertising is in Section 4 of our Privacy Policy.
We may update this Policy from time to time — for example, when we add a new feature that uses a new cookie. Material changes are reflected in the "Last updated" date above and, as described in Section 4, may cause the consent banner to reappear so your choice stays current.
Questions about this Cookies Policy, or about a specific cookie we use? Get in touch or email support@iswap.pk.