Cookie Policy
Applies to: cashxchain.com, app.cashxchain.com, auth.cashxchain.com, dev.cashxchain.com, docs.cashxchain.com, demo.cashxchain.com, legal.cashxchain.com and their sandbox equivalents (*.sandbox.cashxchain.com).
1. Introduction
This Cookie Policy explains how CashXChain UG (haftungsbeschränkt), Eduard-Rüber-Straße 7, 83022 Rosenheim, Germany (“CashXChain”, “we”, “us”), uses cookies and similar technologies on our websites and web applications listed above.
It should be read together with our Privacy Policy, which explains how we process personal data more generally. This document describes what is stored on your device, why, for how long, and how you can control it.
2. Summary — what we do and do not do
We do not use advertising, marketing, or cross-site tracking cookies. Apart from Cloudflare’s cookieless web analytics, which stores nothing on your device, we run no Google Analytics, Google Tag Manager, Meta/Facebook Pixel, LinkedIn Insight, or comparable third-party analytics or ad-tech on any CashXChain property. We do not sell or share personal data with advertisers.
The cookies we set fall into three groups only:
• Strictly necessary — required to sign you in and keep your session secure. These cannot be switched off.
• Functional — remember minor preferences such as language and interface layout, and let our website see that you are signed in.
• Security / anti-abuse — provided by our infrastructure partner Cloudflare to protect against bots and fraud.
Our public marketing site (cashxchain.com) itself writes no cookies and nothing to your browser’s storage: switching language there only changes the page address (/en or /de), and a theme you switch to is not stored. When you open it, Cloudflare’s bot detection sets its security cookie cf_clearance without showing a challenge; it is valid for one year, and Cloudflare may also set the other security cookies described in Section 6. On each page the site checks whether the __Secure-cxc.signed_in cookie described in Section 5 is present and, if it is, shows “Go to dashboard”. Its contact page embeds a Google map and our Google Calendar booking page. Both load from Google without a click, so Google receives your IP address and may set or read its own cookies within them. A video in our blog loads from YouTube only when you press play. See Section 7.
3. What are cookies and similar technologies?
A cookie is a small text file placed on your device by a website. Cookies can be session (deleted when you close the browser) or persistent (kept for a defined period). A first-party cookie is set by the site you are visiting; a third-party cookie is set by another domain.
We also use similar technologies that are not cookies but are treated the same way under EU law — chiefly the browser’s localStorage. These are listed in Section 8.
4. Strictly necessary cookies
Set by our authentication service (auth.cashxchain.com, powered by our self-hosted Better Auth on Cloudflare). They are needed to log you in, keep you logged in across our sub-domains, carry through steps you start (such as a plan you selected) and protect your account. We therefore treat them as strictly necessary; they do not require your consent (§ 25(2) No. 2 TDDDG ). All of them are served only over HTTPS (Secure), use SameSite=Lax and cannot be read by page scripts (HttpOnly). Unless the table says otherwise, they apply to .cashxchain.com so that our sub-domains can recognise your sign-in. The names below are the production names; in the sandbox, cxc-sandbox replaces cxc and sandbox.cashxchain.com replaces cashxchain.com. Merely visiting, without starting a sign-in, sets none of them, except cxc.pending-plan when you open a link that preselects a plan. The others are set only once you start signing in; mobile_pkce is set when our mobile app opens sign-in in your browser.
| Cookie / key | Provider | Purpose | Duration |
|---|---|---|---|
| __Secure-cxc.session_token | CashXChain (auth) | Maintains your authenticated login session. | 90 days, renewed at most once a day while you use the service; deleted when you sign out |
| __Secure-cxc.session_data | CashXChain (auth) | Short-lived signed copy of your session, including your name and email address, so that not every request needs a database lookup. May be split into numbered parts (.0, .1). | 5 minutes |
| __Secure-cxc.session_token_multi-… | CashXChain (auth) | Signed copy of the session token, set with each sign-in alongside the session cookie: one for each account signed in on this browser (up to 10). Used by our multi-session support, for example to end all of these sessions when you sign out. | 90 days from sign-in (not renewed); deleted when you sign out |
| cxc.presence | CashXChain (auth) | Idle screen lock: records, bound to your session, that you were active in the last 10 minutes, or that you locked the screen. Presence lapses at the latest 12 hours after your last sign-in or unlock. | Until you close the browser |
| __Secure-cxc.second_factor | CashXChain (auth) | Points to the pending second-factor check while you complete sign-in. | 10 minutes |
| __Secure-cxc.two_factor | CashXChain (auth) | Carries state while you enter an authenticator-app code or a backup code after a password sign-in. | 10 minutes |
| __Secure-cxc.state | CashXChain (auth) | CSRF protection during social sign-in or account linking (Google, Apple, Microsoft, GitHub, LinkedIn); the matching data is held on our server. | 5 minutes (deleted when sign-in completes) |
| __Secure-cxc.better-auth-passkey | CashXChain (auth) | One-time challenge when you sign in or unlock the screen with a passkey, or register a passkey (WebAuthn). | 5 minutes |
| cxc.device | CashXChain (auth) | Random device identifier, set only after you sign in, so that we can email you when your account is signed in from a device we have not seen before. We store only a hash of it, with your account. auth.cashxchain.com only. | Up to 400 days |
| cxc.pending-plan | CashXChain (auth) | Remembers the plan preselected in a link you followed, through sign-in or sign-up, until you reach plan selection. auth.cashxchain.com only; set before sign-in when you open such a link. | 1 hour |
| mobile_pkce | CashXChain (auth) | Carries security parameters of our mobile app through the sign-in in your browser. auth.cashxchain.com only. | 10 minutes |
Note: the second-factor, passkey, social sign-in, plan and mobile-app cookies appear only when you use those features.
5. Functional cookies
These remember minor choices, or let our website see that you are signed in, to improve your experience. They hold no identifying or tracking data.
| Cookie / key | Provider | Purpose | Duration |
|---|---|---|---|
| __Secure-cxc.signed_in | CashXChain (auth), read by our website | Tells our website (cashxchain.com) that you are signed in, so it shows “Go to dashboard” instead of the “Log in” and “Create account” buttons. Its value is always “1”: it contains no token or identifier and grants no access. Set and deleted together with the session cookie. Unlike the cookies in Section 4, page scripts can read it (not HttpOnly), because our website reads it. Applies to .cashxchain.com; Secure, SameSite=Lax. Sandbox: __Secure-cxc-sandbox.signed_in on .sandbox.cashxchain.com. | Same as the session cookie (90 days, renewed with it); deleted when you sign out |
| NEXT_LOCALE | CashXChain (Legal Center) | Written by the language menu of our Legal Center (legal.cashxchain.com) when you pick a language there; the EN / DE links in the page header do not set it. It holds only “en” or “de”. The Legal Center does not currently read it back: the language follows the page address and your browser’s language settings. | 1 year |
| sidebar_state | CashXChain (web app) | Remembers whether the dashboard sidebar is expanded or collapsed. | 7 days |
6. Security and anti-abuse cookies (Cloudflare)
All CashXChain domains are served through Cloudflare, our infrastructure and security provider. Cloudflare sets its own cookies at the network edge to protect the service against bots, abuse and fraud. On a normal visit to any of our sites Cloudflare currently sets one cookie, cf_clearance; it may set the others below when its bot-management or rate-limiting features act on a request. These are provided by Cloudflare, Inc. and are treated as third-party.
| Cookie / key | Provider | Purpose | Duration |
|---|---|---|---|
| cf_clearance | Cloudflare (bot detection) | Set when you first open one of our sites, without any action on your part: a script that Cloudflare adds to our pages runs Cloudflare’s invisible bot checks (JavaScript Detections), and the cookie stores their result so that Cloudflare can tell browsers apart from automated traffic. Cloudflare renews it from time to time while you browse. Applies to cashxchain.com, so it is also sent to our sub-domains; HttpOnly, Secure, SameSite=None, partitioned (CHIPS). | 1 year |
| __cf_bm | Cloudflare | Bot-management: distinguishes humans from automated traffic. Cannot be read by page scripts (HttpOnly). | 30 minutes |
| _cfuvid / __cfruid | Cloudflare | Supports Cloudflare rate-limiting rules; not used for cross-site tracking. | Session |
We also use Cloudflare Turnstile (a privacy-preserving CAPTCHA alternative) on sign-in, registration and password reset at auth.cashxchain.com (including the password section of your account settings) and on the contact form at cashxchain.com. The Turnstile widget loads from challenges.cloudflare.com as soon as such a page opens. On auth.cashxchain.com it stays invisible unless Cloudflare needs you to interact; on the contact form it is visible. Turnstile issues a one-time token that our server verifies with Cloudflare (“siteverify”). Turnstile sets no cookie on our domains; inside its own frame it keeps the local-storage entry cf.turnstile.u listed in Section 8. Cloudflare states that it does not track users from site to site with its bot-management cookie __cf_bm; cf_clearance is partitioned (CHIPS) and is not shared with other websites. Cloudflare describes its processing for Turnstile in its Turnstile Privacy Addendum . See Cloudflare’s cookie documentation for the authoritative, current list.
7. Third-party sign-in and embedded content
If you choose to sign in with Google, Apple, Microsoft, GitHub or LinkedIn, that provider will set its own cookies on its own domain during the sign-in redirect, under its own privacy and cookie policies. CashXChain does not control those cookies and receives only the account information you authorise. If you sign in with an email and password instead, no third-party sign-in cookies are involved.
Our contact page (www.cashxchain.com/en/contact and /de/contact) embeds two Google services (provided by Google Ireland Limited for visitors in the European Economic Area and Switzerland, and by Google LLC elsewhere). Neither needs a click to load:
• Google Maps — a map of our office, which loads together with the page. Your browser contacts Google servers, including www.google.com , maps.googleapis.com and maps.gstatic.com, and sends them your IP address and browser details; www.google.com also receives the full address of our contact page.
• Google Calendar — our appointment booking page, next to the contact form (below it on narrow screens). It loads as soon as it is on or near the screen, which is often together with the page, before you scroll. Your browser contacts Google servers, including calendar.google.com and www.gstatic.com , and sends them your IP address, browser details and the address of our website (without the page path). calendar.google.com responds by trying to set its cookie NID (domain google.com, about 6 months). Whether your browser stores it depends on the browser and its settings: Chromium-based browsers such as Chrome and Edge reject it in this context by default; other browsers may store it.
If your browser already holds cookies from google.com, for example because you are signed in to a Google account, and allows them in embedded content, it sends them to Google with these requests. The “Book a meeting” and “Get directions” buttons elsewhere on the page are plain links that open Google only when you click them.
We decide whether these frames load on our page. What Google stores on or reads from your device inside them, and what it does with the data it receives, is set by Google under its own privacy and cookie policies (policies.google.com). See Section 9 for the legal basis.
The launch video in our blog loads from YouTube (youtube-nocookie.com, Google) only when you press play; until then we show an image from our own server and nothing is sent to Google. After you press play, your browser contacts YouTube and Google servers (including youtube-nocookie.com, googlevideo.com, ytimg.com and google.com) and sends them your IP address and browser details. YouTube then stores entries in your browser’s local storage and IndexedDB within its frame (listed in Section 8) and may use further browser storage there. The WhatsApp buttons on our website are plain links: nothing is sent to WhatsApp (Meta) until you click one.
8. Similar technologies (local storage)
The following are stored in your browser’s local storage (for YouTube, also IndexedDB) rather than as cookies. Our own entries are not transmitted to our servers and remain on your device until cleared. The Cloudflare and YouTube entries are written by those providers inside their own embedded frames; our pages cannot read them. Our marketing site stores no theme choice: its theme switch applies only until the page is reloaded.
| Key | Purpose | Where |
|---|---|---|
| theme | Remembers the light / dark / system theme you choose. Written only when you change it. | Web app (app.cashxchain.com) and legal.cashxchain.com (localStorage) |
| lang | Remembers the interface language (English / German) you choose in the web app. Written only when you switch. | Web app (localStorage) |
| better-auth.message | Lets other open tabs notice that you signed out or that your account or session changed, so they update. Written only when that happens. Holds only the event type, a random message ID and a timestamp. | auth.cashxchain.com and web app (localStorage) |
| cxc-onboarding-checklist | Saves the track you choose (company / sole trader) and the items you tick on our public onboarding checklist. Written as soon as you open the checklist and updated as you use it. | auth.cashxchain.com/checklist (localStorage) |
| cxc_auto_logout_disabled | Sandbox only: remembers whether you switched off the “Auto-logout” option in the web app. Written only when you use that switch. | Web app in the sandbox (localStorage) |
| cf.turnstile.u | Cloudflare Turnstile’s own entry inside its widget frame, stored when a page with Turnstile loads. Our pages cannot read it. | Turnstile frame on sign-in, registration and password reset at auth.cashxchain.com (including the password section of your account settings) and on the contact form at cashxchain.com (localStorage of challenges.cloudflare.com) |
| YouTube player data (for example yt-icons-last-purged, yt-player-caption-persistence, ytidb::LAST_RESULT_ENTRY_KEY and the IndexedDB database YtIdbMeta) | YouTube player state, written by YouTube only after you press play on a blog video. | YouTube frame (localStorage and IndexedDB of www.youtube-nocookie.com ) |
9. Legal basis
Under the EU ePrivacy Directive and the German TDDDG (formerly TTDSG), storing or reading information on your device requires your consent unless it is strictly necessary to provide a service you have explicitly requested. We rely on:
• Strict necessity — for the authentication and security cookies in Sections 4 and 6, which are required to deliver a service you have asked for and to keep it secure (§ 25(2) No. 2 TDDDG ).
• Consent (Art. 6(1)(a) GDPR / § 25(1) TDDDG ) — where required for non-essential cookies. Because we currently deploy no analytics or advertising cookies, no consent banner is required for those categories. Functional cookies are set only in response to something you do (choosing a language or layout, or signing in). The sign-in cookie __Secure-cxc.signed_in and the layout cookie sidebar_state are strictly necessary for that function (§ 25(2) No. 2 TDDDG ); the related processing rests on Article 6(1)(f) GDPR . The language cookie NEXT_LOCALE is written by the Legal Center’s language menu but is not currently read back (Section 5).
• Embedded content (Section 7) — the Google map and the Google Calendar booking page currently load with our contact page, without asking for your consent. We set no cookie of our own for them, but when they load your browser connects to Google, which receives your IP address and browser information and may read or set its own cookies within its frames. We rely on our legitimate interest in showing where we are and in letting you book a call directly (Article 6(1)(f) GDPR ). The YouTube video in our blog is different: it loads from youtube-nocookie.com only when you press play, and nothing is requested from Google before that. The transmission of your data to Google after you press play rests on our legitimate interest in showing you the video you have chosen to watch (Article 6(1)(f) GDPR ).
If we introduce analytics or marketing technologies, we will ask for your consent before activating them and update this policy.
10. How to manage or delete cookies
You can control cookies through your browser settings — view, delete, or block them. Blocking strictly necessary cookies will prevent you from signing in and using the web application.
• Chrome: Settings → Privacy and security → Third-party cookies / Site data.
• Safari: Settings → Privacy → Manage Website Data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Edge: Settings → Cookies and site permissions.
You can also sign out at any time from your account menu, which clears your session cookies.
11. Changes to this policy
We may update this Cookie Policy to reflect changes to our technologies or legal obligations. Material changes will be dated at the top of this document and, where required, notified to you.
12. Contact
CashXChain UG (haftungsbeschränkt) — Rosenheim, Germany
CashXChain Inc. — New York, NY, USA (incorporated in Delaware)
Email: privacy@cashxchain.com
Website: https://cashxchain.com