Cookie Policy
The short version. We use cookies to keep you logged in, remember your language, and find out when something crashes. We do not use advertising cookies, and we do not let anyone track you across other websites. You can reject everything except the cookies that are strictly necessary to make the site work.
1. What this covers
This policy explains the cookies and similar technologies used on LetsHoraro.com, our admin panel, and any web pages we operate. It also covers equivalent technologies in our mobile apps — mobile apps do not use cookies as such, but they use local storage and device identifiers that do a similar job, and we treat them the same way.
This policy sits alongside our Privacy Policy, which explains what we do with the data more generally.
2. What these technologies are
| Technology | What it is |
|---|---|
| Cookies | Small text files a website stores in your browser |
| Local storage | A larger, longer-lived browser store used by web apps |
| Session storage | Like local storage, but wiped when you close the tab |
| Device identifiers | Identifiers our apps use in place of cookies, including push notification tokens |
| SDKs | Code libraries inside our apps that may collect diagnostic data |
We call all of these "cookies" in this policy for readability.
3. What we use, and why
3.1 Strictly necessary — always on
These cannot be switched off. Without them the site does not function, and we do not ask for consent because none is required for cookies that are essential to a service you have asked for.
| Purpose | What it does | Lifetime |
|---|---|---|
| Authentication | Keeps you logged in between pages | Session, or up to 30 days if you choose "stay signed in" |
| Security | Protects against cross-site request forgery and session hijacking | Session |
| Load balancing | Routes your request to a working server | Session |
| Consent record | Remembers your cookie choices so we stop asking | 12 months |
| Language | Remembers whether you chose English or Arabic, and text direction | 12 months |
| Checkout state | Keeps your basket and order details during checkout | Session |
3.2 Functional — optional
| Purpose | What it does | Lifetime |
|---|---|---|
| Display preferences | Light/dark/system theme, font size, chat wallpaper | 12 months |
| Recently viewed | Shows gifts you looked at recently | 30 days |
| Accessibility settings | Remembers text scaling and related choices | 12 months |
3.3 Performance and diagnostics — optional
| Purpose | What it does | Lifetime |
|---|---|---|
| Crash reporting | Tells us when something broke, and what page you were on | 90 days |
| Performance monitoring | Measures page load and API response times | 90 days |
| Error logging | Records technical errors so we can fix them | 90 days |
This data is aggregated and used only to keep the product working. It is not used to build a profile of you.
3.4 What we do not use
We want to be specific rather than vague about this, because "we value your privacy" banners usually mean the opposite.
- ❌ No advertising cookies. We do not sell advertising and we do not place ad-network tags.
- ❌ No third-party behavioural analytics. No Google Analytics, no Meta Pixel, no TikTok Pixel, no LinkedIn Insight Tag.
- ❌ No cross-site tracking. Nothing we set follows you to other websites.
- ❌ No data brokers. We do not share cookie data with anyone who sells audience data.
- ❌ No fingerprinting. We do not attempt to identify you by device characteristics when you have declined cookies.
4. Third-party cookies
A small number of third parties may set cookies when you use specific features:
| Third party | When | What for | Their policy |
|---|---|---|---|
| Payment processor | Only on payment pages | Fraud prevention and processing your payment | Sub-processors |
| Courier tracking provider | Only if you open embedded tracking | Delivery tracking | Sub-processors |
We do not control these cookies. They are set by the third party under their own policy. We only load them when you use the feature that needs them — payment cookies do not load while you are browsing the gift catalogue.
5. Your choices
5.1 Our cookie banner
The first time you visit, you can:
- Accept all — everything in Section 3
- Reject all — only strictly necessary cookies
- Manage preferences — choose category by category
Rejecting is as easy as accepting. There is a single-click "Reject all" button at the same level as "Accept all". You can change your mind at any time at letshoraro.com/cookie-settings or via the "Cookie Settings" link in our footer.
5.2 In the mobile apps
Go to Settings → Privacy → Diagnostics to turn crash and performance reporting on or off. Push notification tokens are controlled by your device's notification permission.
5.3 In your browser
You can also block or delete cookies through your browser settings:
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
- Firefox: Settings → Privacy & Security
- Edge: Settings → Cookies and site permissions
Be aware: blocking strictly necessary cookies in your browser will break login and checkout. That is not something we can work around.
5.4 Do Not Track and Global Privacy Control
We honour Global Privacy Control (GPC) signals as a valid request to reject optional cookies. Browser "Do Not Track" headers are not consistently defined across browsers, so we do not rely on them alone — but since we do not run advertising or cross-site tracking, there is little for them to disable.
6. How long your consent lasts
Your cookie choice is stored for 12 months, after which we will ask again. We will also ask again if we add a new cookie category, or a new third-party cookie, that your existing choice does not cover.
7. Changes
We will update this policy if our cookie use changes. Material changes will trigger a fresh consent request rather than a silent update.
8. Questions
privacy@letshoraro.com · Data Protection Officer: dpo@letshoraro.com
Implementation note — delete before publishing. This policy describes a genuinely minimal cookie footprint, which matches the commitment in your SRS to avoid third-party analytics. Before publishing, run a cookie audit on the live site and confirm the tables above are accurate — the most common cause of a cookie policy being wrong is a marketing tag added later that nobody told legal about. Re-audit after every marketing tool you add.