Cookie Policy
Cookie Usage Policy
Effective date: Last updated:
Table of Contents
A cookie is a small text file that a website saves on your device when you visit it. On your next visit, the cookie tells the site that you've been before — this helps it remember your preferences, keep you logged in, or measure usage.
This Policy also covers similar technologies with the same effect: localStorage, sessionStorage, pixels, SDK identifiers used by some third-party providers. We refer to all of these collectively as "cookies".
Cookies can be:
-
First-party — set by MiOON itself; or
-
Third-party — set by a third-party provider (for example, our analytics platform).
And:
-
Session cookies — deleted when you close your browser; or
-
Persistent cookies — stored for a set period or until you delete them.
We divide cookies into four groups:
| Category | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Authentication, security (CSRF), session management. The Platform cannot function without them. | No (cannot be declined without losing the ability to use the Platform) |
| Functional | Remember preferences (for example, your language choice). | No, but you can clear them |
| Analytics | Measure Platform usage to help us improve it. Pseudonymous — linked to a random identifier, not a phone. | Yes for residents of Thailand and the EEA; right to object for other regions |
| Session recording (admin/moderator only) | Bug replay in internal admin tools. Only set when a staff member logs in to /admin/*. | Not set for Buyers or Sellers |
The table below lists the cookies and similar technologies currently in use. The list is updated as the Platform evolves (see Section 7).
| Name | Set by | Purpose | Duration | Effect of blocking |
|---|---|---|---|---|
| mioon_session | MiOON (first-party) | Opaque session token for your authentication. Mapped on the server to session storage (Redis). httpOnly, Secure, SameSite=Lax. | Up to 30 days of inactivity, then re-login required | Cannot stay logged in; key features (posting Listings, account management, favourites) will not work |
| mioon_csrf | MiOON (first-party) | CSRF protection (double-submit pattern). Non-httpOnly so the client can read it; a paired server-side token is verified on state-changing requests. | Same as session | State-changing actions (posting, editing, deleting) will not work |
| mioon_role | MiOON (first-party) | HMAC-signed cookie with an opaque role string. Used by the edge proxy for route access control (e.g. blocking /admin/* for non-admins). Contains no permissions or sensitive data. httpOnly, Secure. | Same as session | Route-protected paths (admin panel) will deny access |
| __cf_bm, cf_clearance, others | Cloudflare (third-party) | Bot management and challenge tokens from our CDN/WAF — distinguishing human from automated traffic. | Usually 30 minutes (cf_bm) and up to 30 days (cf_clearance) — managed by the provider | Some pages may fail to load or repeatedly show a security challenge |
3.1. Strictly necessary
3.2. Functional
| Name | Set by | Purpose | Duration | Effect of blocking |
|---|---|---|---|---|
| NEXT_LOCALE | MiOON (first-party) | Remembers your chosen interface language (English, Russian, Thai) so the same language is shown on your next visit. | 1 year | Each visit defaults to the browser language; no other UX impact |
| mioon_cookie_consent | MiOON (first-party) | Records your choice in the banner so we don't ask again every visit. Stores the analytics consent status. | 1 year | We will ask for your preferences every visit |
3.3. Analytics
| Name | Set by | Purpose | Duration | Effect of blocking |
|---|---|---|---|---|
| ph__posthog (PostHog distinct_id) | PostHog (third-party — see §4) | Random pseudonymous identifier for counting unique visitors, analysing feature usage, funnels, page views, and other product events without directly identifying by phone number. | 1 year by default, or the period configured in PostHog settings | Analytics are not collected from your session; the Platform continues to work |
| PostHog sessionid | PostHog (third-party) | Groups events from a single user session to understand the sequence of actions on the Platform and improve the product. | 30 minutes of inactivity, or the period configured in PostHog settings | Session analytics unavailable; no other effect |
3.4. Session recording (admin / moderator only)
| Name | Set by | Purpose | Duration | Effect of blocking |
|---|---|---|---|---|
| Sentry Replay identifiers | Sentry (third-party — see §4) | Used for technical error replay, incident investigation, and improving Platform stability. May be used on user-facing Platform pages. Text content is masked and media is blocked to reduce the risk of personal data entering diagnostic records. Not used for advertising, retargeting, or behavioural profiling. | Per Sentry settings | Less technical context for error investigations; core Platform features continue to work |
| PostHog session-recording identifiers | PostHog (third-party — see §4) | Not used on public user-facing routes unless that feature is explicitly enabled in PostHog settings. If session recording is enabled in the future, this Policy will be updated before such use begins. | No effect on core Platform features |
3.5. Error tracking
| Name | Set by | Purpose | Duration | Effect of blocking |
|---|---|---|---|---|
| Sentry session identifier | Sentry (third-party) | Links an error to a session for replay by engineers. Ephemeral; not used for cross-session identification. | Per Sentry settings | Less context for investigating an error you encountered |
The Platform integrates the following third-party providers, which may set cookies or read identifiers:
| Provider | Purpose | Region | Privacy policy |
|---|---|---|---|
| PostHog | Product analytics; admin-only session recording | EU (default region) | https://posthog.com/privacy |
| Sentry | Error tracking and performance monitoring | USA or EU (configurable) | https://sentry.io/privacy/ |
| Cloudflare | Content delivery, security, bot management | Global edge | https://www.cloudflare.com/privacypolicy/ |
| MapTiler | Vector map tiles | Multi-region CDN | https://www.maptiler.com/privacy-policy/ |
We do not allow third-party advertising trackers (Google Ads, Meta Pixel, TikTok Pixel) on the Platform.
5.1. Through our banner
On your first visit from a location where consent is required (residents of Thailand and the EEA), you will see a cookie banner with options:
-
Accept all — strictly necessary, functional, and analytics cookies are set;
-
Reject non-essential — strictly necessary and functional cookies only;
-
Manage preferences — granular toggles by category.
You can change your choice at any time via the "Cookie settings" link in the footer.
5.2. Through your browser
You can also block or delete cookies through your browser settings. Instructions differ by browser:
-
Chrome: Settings → Privacy and security → Cookies and other site data
-
Safari: Settings → Privacy → Manage Website Data
-
Firefox: Settings → Privacy & Security → Cookies and Site Data
-
Edge: Settings → Cookies and site permissions → Cookies and site data
Disabling strictly necessary cookies will prevent the Platform from working. Disabling others — see the "Effect of blocking" column in Section 3.
5.3. Do Not Track
Some browsers support the Do Not Track signal. There is no industry consensus on how to interpret it. We treat Do Not Track as equivalent to opting out of analytics cookies for the current session.
5.4. Mobile devices
If you access the Platform through a mobile browser, the same instructions apply. If we release a wrapped mobile application in the future, additional controls (for example, resetting an advertising identifier) will be described separately.
-
Consent and withdrawal
-
Changes to this Policy
We update this Policy when tools using cookies are added, removed, or replaced. When we do:
-
We update the "Last updated" date at the beginning of the document;
-
For a material change (new analytics provider, expanded categories, change of legal basis) — we will show the cookie banner again;
-
We publish a summary of changes in the changelog for at least 30 days.
- Contacts
For questions about this Policy or the cookies we use:
-
Email: legal@mioon.com
-
In the application: the "Cookie settings" link in the footer