Cookie policy
We set one cookie, only after you sign in, and it does nothing but keep you signed in. This page explains it and lists what we deliberately do not use.
In force from 27 August 2026. Last revised 27 August 2026.
Contents
1. The short version
We set one cookie, and only after you sign in. It keeps you signed in and does nothing else. We use no analytics, no advertising and no third-party cookies, and we do not track you across other websites.
Reading this site sets no cookie at all. If you never sign in, no cookie is ever stored on your device by us.
Because of that there is no consent banner. Under the EU ePrivacy Directive and its national implementations, and the equivalent rules elsewhere, a cookie that is strictly necessary to provide a service the user has asked for does not require consent. A sign-in cookie set only after you choose to sign in is exactly that. We would rather not show you a banner asking permission we do not need.
2. The cookie we set
| Name | Purpose | When it is set | How long | Type |
|---|---|---|---|---|
bsf_session | Keeps you signed in as you move between pages. It contains a random token and nothing else — no name, no email address, no personal information of any kind. | Only when you sign in. | 7 days, or until you sign out. | Strictly necessary. First-party. |
The cookie is set with the following protections:
- HttpOnly — a script running in the page cannot read it, so a cross-site scripting flaw could not steal your session.
- Secure — it is only ever sent over an encrypted HTTPS connection.
- SameSite=Lax — it is not sent when another website makes a request to ours, which protects you from cross-site request forgery.
What we store on our side is a one-way hash of the token, not the token itself, so the value in your browser cannot be recovered from our database.
3. What we do not use
- No analytics. No Google Analytics, no Plausible, no Matomo, nothing. We do not measure your behaviour on the site.
- No advertising or tracking cookies, and no advertising network has any presence on this site.
- No third-party cookies, and no social media buttons, embedded videos, chat widgets, tag managers or pixels.
- No fingerprinting. We do not attempt to identify your device by its characteristics.
- No third-party fonts. Typefaces are served from this site. Many websites load fonts from another company's servers, which sends your IP address to that company every time you open a page; we do not, so opening a page here contacts no one but us.
4. Other things stored on your device
Apart from the sign-in cookie, the site may keep small amounts of information in your browser's local storage while you are filling in a request for proposal, so that a half-finished form survives a reload. That stays on your device, is never sent to us except as part of the form you submit, and you can clear it in your browser at any time.
Your browser will also cache pages, stylesheets, fonts and images so the site loads faster on your next visit. That is ordinary browser behaviour and involves no tracking.
5. How to control cookies
You can delete or block cookies through your browser settings. Every major browser lets you see what is stored, remove it, and refuse cookies from particular sites or all sites.
If you block the bsf_session cookie you can still read the whole public site — the directory, every category, every vendor profile and every review. You will not be able to sign in, because staying signed in is precisely what the cookie does.
Signing out deletes the cookie immediately, in your browser and on our side.
6. Changes, and how to reach us
If we ever add a cookie we will update this page before we do, and if it is not strictly necessary we will ask your permission first.
Questions about this policy go to privacy@buysidefintech.com. How we handle personal information generally is in our privacy policy.