Cookies Policy
Last updated: November 4, 2026
This Cookies Policy explains what cookies and similar technologies iswap.pk ("we", "us", "our"), operated by ISWAP SMC-PRIVATE LIMITED, uses on the website and mobile applications (the "Platform"); why we use each one; how long it lasts; and how you can accept, decline, or change your choice at any time. It should be read together with our Privacy Policy, which governs our use of personal information more broadly, and our Terms & Conditions.
1. What Are Cookies?
A cookie is a small text file that a website stores in your browser. It lets the site remember information about your visit — such as whether you're signed in, or a preference you set — the next time you load a page or return to the site. "Similar technologies" covers things that work the same way for this purpose, such as your browser's local storage (used to remember your cookie choice itself, described in Section 4).
A device/browser fingerprint is not a cookie, and is not covered by this policy. It works differently and is addressed separately — see Section 8 below and Section 5 of our Privacy Policy.
Receiver CNIC details are not stored in cookies or your browser's local storage. The CNIC number and name you enter at checkout are saved on our servers. Your strictly necessary sign-in cookie only tells us which account is asking for them, and the number is masked when shown back to you. See Section 2 of our Privacy Policy.
2. Your Consent to This Policy
When you first visit the Platform, a banner at the bottom of the page asks you to choose "Accept All" or "Necessary Only." That choice is your consent (or refusal of consent) to the optional cookies described in this Policy — strictly necessary cookies are used either way, since the Platform cannot function without them.
- Consent-Based Processing: For any cookie that isn't strictly necessary, your consent — given through the banner — is our legal basis for setting it. You can withdraw that consent at any time as described in Section 4.
- Strictly Necessary Cookies Need No Consent: Cookies required to operate core functionality you've requested — such as staying signed in — are used regardless of your banner choice, consistent with the "strictly necessary" exemption recognized under cookie-consent laws (including the EU's ePrivacy rules, which the GDPR framework in our Privacy Policy operates alongside).
- If You Do Not Consent: Choosing "Necessary Only" is fully respected — no optional cookie described in Section 6 or 7 below is set. The Platform remains fully usable; declining does not block sign-up, sign-in, or posting a listing.
3. Categories of Cookies We Use
We group cookies into five categories. The tables in Sections 5 through 7 and Section 9 list the specific cookies in each.
- Strictly Necessary: Required for the Platform to function — signing in, staying signed in, and completing a secure Google sign-in redirect. Always active.
- Functional: Remembers a choice you made, such as your cookie consent preference itself. Always active (it has to be, to remember your choice about the others).
- Security & Fraud Prevention: Google reCAPTCHA's cookies, which tell genuine visitors apart from bots on forms we protect. Treated as necessary for the Platform's security, so active regardless of your banner choice.
- Sign-In (Third-Party): Only set if you actively choose to sign in with Google — Google's own cookies for completing that sign-in.
- Analytics: Google Analytics cookies that help us understand how the Platform is used — which pages are visited, how people find us, and where things are slow. Only set after you choose "Accept All".
Analytics cookies are the only cookies controlled by the "Accept All" / "Necessary Only" choice in our consent banner. Choosing "Necessary Only", or not choosing yet, keeps them off — see Section 9. We do not use advertising cookies (Section 10).
4. Managing Your Choice
- Changing Your Mind: To review or change the choice you made in the cookie banner, use the "Manage Cookie Preferences" button below, or clear your browser's local storage for iswap.pk — either reopens the banner so you can choose again.
- Browser Controls: Most browsers let you block or delete cookies through their settings, and let you browse in a private/incognito mode that discards cookies when you close the window. Blocking strictly necessary cookies will prevent you from staying signed in.
- Re-Asking After Updates: If we materially change what this Policy covers — for example, adding a new category of cookie — the banner will reappear even if you've previously made a choice, so your consent always reflects the current version of this Policy.
- Record of Your Choice: We keep a record of each choice you make in the banner — the choice, the version of this Policy it was made under, the date and time, a random ID for your browser, and your browser type — so we can show what you agreed to. If you're signed in, or sign in later on the same browser, the record is linked to your account.
5. Strictly Necessary Cookies (First-Party)
Set by iswap.pk itself. These keep you signed in and keep the Google sign-in flow secure; they cannot be disabled through our consent banner, though you can block them yourself through your browser at the cost of being signed out on every visit.
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| authjs.session-token (or __Secure-authjs.session-token) | Keeps you signed in as you move between pages. | iswap.pk | Up to 30 days, or until you sign out |
| authjs.csrf-token | Protects the sign-in form against cross-site request forgery. | iswap.pk | Session |
| authjs.callback-url | Remembers where to send you back to after signing in. | iswap.pk | Session |
| iswap-pending-google-link | Temporarily holds a verified Google identity while you confirm linking it to an existing password account. | iswap.pk | 10 minutes |
| iswap-google-link-intent | Confirms it's really you connecting a Google account from My Account settings, not someone else's Google sign-in. | iswap.pk | 10 minutes |
| iswap-pending-visitor-id | Carries the fraud-prevention device signal described in Section 5 of our Privacy Policy across the brief redirect to Google and back during sign-in — see below for why this is needed. | iswap.pk | 10 minutes |
6. Functional Cookies
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| iswap_cookie_consent | Remembers the choice you make in our cookie banner, so we don't ask again on every visit. | iswap.pk (stored in your browser's local storage, not a cookie) | Until you clear your browser data or change your choice |
7. Security & Fraud Prevention, and Sign-In Cookies (Third-Party)
Security & Fraud Prevention
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| _GRECAPTCHA and related reCAPTCHA cookies | Distinguishes real visitors from bots and scripts on forms we protect (sign-up, sign-in, posting a listing). | Google reCAPTCHA | Set and controlled by Google — see Google's Cookie Policy |
Sign-In
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| Google account/session cookies (e.g. under accounts.google.com) | Google's own cookies, set only if you choose to sign in with Google or Google One Tap, so Google can complete that sign-in. | Set and controlled by Google |
These are set by Google, not by us, and are governed by Google's Cookie Policy. We only receive the result of the sign-in or the fraud check — we don't have access to, and can't control, the cookies Google itself sets on your device.
8. Device Fingerprinting Is Not a Cookie
Separately from the cookies on this page, we also use a device/browser fingerprint and record your IP address for fraud prevention — for example, to detect a device linked to a previously banned account. This is a different technique: it isn't stored in your browser and can't be cleared by deleting cookies, because nothing is stored there to delete — it is computed fresh from your device's characteristics each time. Full detail on how it works, when it's used, and your rights over it is in Section 5 of our Privacy Policy, not this Cookies Policy — we call it out here only so the two aren't confused with each other.
9. Analytics and Measurement
Google Analytics
| Cookie | Purpose | Set By | Duration |
|---|---|---|---|
| _ga | Lets Google Analytics tell visits apart, so we can count visitors and see how the Platform is used. | Google Analytics (on behalf of iswap.pk) | 2 years |
| _ga_JH5DZB4MKN | Keeps track of your current visit (session) for Google Analytics. | Google Analytics (on behalf of iswap.pk) | 2 years |
We use Google Analytics to understand how visitors use the Platform. Its cookies are only set after you choose "Accept All". If you choose "Necessary Only", or haven't chosen yet, no Google Analytics cookie is stored on your device: Google Analytics may still receive basic page-visit measurements without cookies, which don't identify you across visits. You can change your choice at any time (Section 4). In the iSwap Android app the consent banner isn't shown; analytics is used there as disclosed in the app's Google Play listing. Google's use of this data is governed by Google's Privacy & Terms.
Measurement tools that don't use cookies
- Vercel Web Analytics: We use this to count page views and understand overall traffic. It's built to work without cookies or any other client-side identifier — it doesn't track you individually or across visits.
- Anonymized Listing/Page Analytics: As described in our Privacy Policy, we record anonymized impression and view counts on listings and Mobile Prices pages. This is stored against the content viewed, not against a cookie in your browser, and is automatically deleted after 30 days.
10. Advertising
The Platform may in the future display advertising served by third-party vendors, including Google, which would use their own cookies (such as the DoubleClick/DART cookie) to serve ads based on your browsing activity. If and when that is active, it will be listed in this Policy with its own entry, and will only load after you choose "Accept All" in the consent banner — it is not active today. Full detail on advertising is in Section 4 of our Privacy Policy.
11. Changes to This Policy
We may update this Policy from time to time — for example, when we add a new feature that uses a new cookie. Material changes are reflected in the "Last updated" date above and, as described in Section 4, may cause the consent banner to reappear so your choice stays current.
12. Contact Us
Questions about this Cookies Policy, or about a specific cookie we use? Get in touch or email support@iswap.pk.