Legal
Cookie Policy
Every cookie Sinfully sets, what it's for and how long it lasts, and how to change your choice.
Last updated
On this page
2.Strictly necessary cookies
These keep you signed in, remember that you're an adult and your cookie choices, and protect the site. They're always on, because the site can't work without them, and the law doesn't require consent for them.
| Cookie | What it does | How long |
|---|---|---|
welcome_offer | Keeps your browser's welcome-offer terms and deadline, so reopening a page or signing up does not restart the countdown. | 400 days (the offer expires at its own displayed deadline) |
interface_language | Remembers the interface language you chose. | 1 year |
adult_ok | Remembers that you confirmed you're 18 or older, so we don't ask on every visit. | 1 year |
authjs.session-token | Keeps you signed in. | 30 days |
authjs.csrf-token | Protects sign-in and account forms from cross-site request forgery. | Until you close your browser |
authjs.callback-url | Takes you back to the page you were on after signing in. | Until you close your browser |
age_verified | Where the law requires an age check, records that you passed it on this device. It holds a signed result, never your ID or images. | 30 days |
cookie_consent | Remembers your cookie choices. | 6 months |
__cf_bmCloudflare | Tells people from bots, to protect the site from attacks. | 30 minutes |
cf_clearanceCloudflare | Set only if Cloudflare asks you to prove you're human, to remember that you passed. | Usually 30 minutes |
welcome_offer400 days (the offer expires at its own displayed deadline)Keeps your browser's welcome-offer terms and deadline, so reopening a page or signing up does not restart the countdown.
interface_language1 yearRemembers the interface language you chose.
adult_ok1 yearRemembers that you confirmed you're 18 or older, so we don't ask on every visit.
authjs.session-token30 daysKeeps you signed in.
authjs.csrf-tokenUntil you close your browserProtects sign-in and account forms from cross-site request forgery.
authjs.callback-urlUntil you close your browserTakes you back to the page you were on after signing in.
age_verified30 daysWhere the law requires an age check, records that you passed it on this device. It holds a signed result, never your ID or images.
cookie_consent6 monthsRemembers your cookie choices.
__cf_bm30 minutesTells people from bots, to protect the site from attacks. Set by Cloudflare.
cf_clearanceUsually 30 minutesSet only if Cloudflare asks you to prove you're human, to remember that you passed. Set by Cloudflare.
On the live site, the sign-in cookies' names start with __Secure- or __Host-, which tells your browser to send them only over a secure connection.
3.Analytics cookies
We use Google Analytics 4 to see how the site is used: which pages are visited, sign-ups, and the steps of an age check (started, passed or failed; never your ID or images). Google also receives your browser and device type, screen size, language, the page that sent you here, and an approximate location from your IP address. Google Analytics doesn't store IP addresses. If you're signed in, we send an internal account number (never your name or email) so visits from your different devices count as one person.
| Cookie | What it does | How long |
|---|---|---|
_gaGoogle | Tells visits apart, so Google Analytics can count visitors. | 2 years |
_ga_<id>Google | Keeps track of the current visit for Google Analytics. | 2 years |
_ga2 yearsTells visits apart, so Google Analytics can count visitors. Set by Google.
_ga_<id>2 yearsKeeps track of the current visit for Google Analytics. Set by Google.
In the European Economic Area, the UK and Switzerland, analytics stays off until you choose “Accept all” or turn it on in Cookie settings. We use Google's Consent Mode (version 2): until you allow analytics, or if you refuse it, no analytics cookies are set and the page sends Google only cookieless signals without identifiers (for example, that a page was viewed), which Google uses to estimate totals. Elsewhere, analytics is on unless you turn it off.
We also count visits ourselves, without cookies: once a day per visitor, by a code made from your IP address and browser that changes every day and can't be traced back to you, with the site or link that sent you.
4.Advertising
The Advertising setting lets Google use the same analytics data to measure our ads: whether someone who saw or clicked one of our ads went on to visit or sign up (Google's ad_storage, ad_user_data and ad_personalization consent signals). It's off until you choose “Accept all” or turn it on in Cookie settings, and you can turn it off again at any time. We don't show third-party ads on Sinfully.
It also lets us remember where you first came from, so we know which of our links and ads lead to sign-ups:
| Cookie | What it does | How long |
|---|---|---|
first_touch | Remembers where you first came from (a link, an ad or a search), so if you sign up we know which of our links and ads work. Only set if you allow advertising cookies. | 30 days |
companion_referral | Remembers the friend or affiliate link you arrived from, so they're credited if you sign up. Only set if you allow advertising cookies. | 30 days |
first_touch30 daysRemembers where you first came from (a link, an ad or a search), so if you sign up we know which of our links and ads work. Only set if you allow advertising cookies.
companion_referral30 daysRemembers the friend or affiliate link you arrived from, so they're credited if you sign up. Only set if you allow advertising cookies.
5.Other storage on your device
We also use your browser's local storage for settings that only matter on this device, such as whether sound is on. If you turn on texts from companions, your browser keeps a push subscription so we can deliver them; you can turn texts off in your settings or in your browser at any time.
6.Changing your choice
- Open Cookie settings, linked at the bottom of every page, to allow or refuse analytics at any time. Your choice is remembered for 6 months, then we ask again.
- Install Google's opt-out add-on (tools.google.com/dlpage/gaoptout) to stop Google Analytics on every site.
- Block or delete cookies in your browser settings. If you block the necessary ones, you won't be able to sign in, and we'll ask you to confirm your age on every visit.
More about how we use your information is in our Privacy Policy. Questions: [email protected].
Questions about this policy?
Email [email protected] and a person will reply.