Cookie Policy
Approved version · BFREE-COOKIE-2026-11-06-v3
Effective from the later of 6 November 2026 (UAE time) and first public publication. No retroactive effect.
Scope
This policy covers cookies and similar storage on the BFREE website, client portal and installed web app. Cookies are small records stored by your browser. Local storage, session storage and the app’s cache can also keep information on your device.
Account session cookies
Supabase Auth uses first-party sb-<project>-auth-token cookies (sometimes split into numbered parts) to maintain and refresh sign-in. Related cookies ending in -code-verifier help complete email verification and password recovery links. The browser storage limit set by our authentication library is up to 400 days per write; sign-in and link validity are checked separately and may end sooner.
Device security cookies
__Host-bfree_device_sign_in is set only after a successful passkey check for an opted-in client and expires after 30 minutes. It proves device verification for the current session and is not for tracking. __Host-bfree_trusted_device is a separate cookie, set when you choose to remember a browser for sign-in alerts; it expires after 30 days and does not replace verification. Both are first-party, HTTPS-only and inaccessible to page scripts.
Language and local storage
bfree_private_language remembers your private-area language for 365 days. Local storage keys bfree-auth-tab-v1 and bfree:history-display-currency:v1:anonymous remember the login or registration tab and public display currency. bfree_purchase_workspace_refresh_v1 signals an account workspace refresh to other tabs. bfree_dld_latest_non_zero_v1, bfree_adrec_latest_non_zero_v1 and bfree_insights_refresh_slot_v1 cache public property statistics and their refresh marker. These local storage keys have no fixed browser expiry; they remain until replaced or cleared.
Session storage and app cache
bfree-verification-requests-v1 holds resend-attempt times for a 15-minute limit in the tab, not email addresses. bfreeSuppressPopupOnce and bfreeAllowContactJump remember one-time navigation choices. Session storage generally ends when the tab closes. The installed app's bfree-public-shell-v5 cache holds the offline page, app icons and manifest until replaced or cleared. It does not cache private account pages or account API responses.
Optional analytics
Optional tracking is off by default. If we offer Google Analytics, it is used to measure public-page visits only after you actively choose to allow it. Google may then receive browser, device and usage information and use cookies or similar storage. You can refuse or withdraw that choice without affecting access to your account. Signing in or acknowledging a policy is not consent to analytics or marketing.
Analytics choices and storage
On Real Estate pages, use Privacy choices in the footer to allow or turn off Google Analytics. If you allow it, local storage key bfree.real-estate.analytics.v1 stores the permission expiry; the choice is valid for 180 days. Analytics cookies bfree_re_ga and bfree_re_ga_* are configured to expire no later than that choice.
External resources
Some pages request Google Fonts or resources from jsDelivr. The Gallery loads an embedded YouTube video only when you choose to load it, separately from your analytics choice. When your browser connects to an external provider, it sends technical information such as your IP address; a video provider may also use its own device storage. These connections are separate from BFREE sign-in. External links are subject to the destination's privacy and cookie practices.
Your controls
You can use browser or device settings to restrict or clear cookies and site data. Where a site offers optional tracking controls, use them to change your choices. Blocking essential storage may prevent sign-in or affect app functions. Browser controls do not erase records already held by BFREE or its providers. For personal data rights or questions, see the Privacy Policy or contact customercare@bfree.care.