re·finds

Cookie statement

Last updated: 17 October 2026

The Dutch version of this text is the source. If the two versions differ in meaning, the Dutch version prevails.

On the website Refinds places strictly necessary, functional cookies only and uses no analytics cookies, advertising cookies or third-party trackers; that is why there is no cookie banner on the website. The app stores a pseudonymous installation identifier for our own usage statistics, without third parties — how that works and how to turn it off is set out in privacy statement §5.7.

This statement belongs with the privacy statement and is authoritative for everything to do with cookies and local storage.

A cookie is a small text file that a website places on your device and that is automatically sent along with every subsequent request. Local storage (localStorage, sessionStorage, or a database inside the app), by contrast, stays on your device and is not sent automatically — with one exception: as long as you have not turned off the usage statistics in privacy statement §5.7, the installation identifier, your language and country setting, the place you view most often in the app (counted locally) and the kind of the first item you saved do travel to our server. For everything else: we do not see that data unless you share something yourself.

The distinction matters: consent is required for placing non-essential cookies; it is not required for storing your own preferences on your own device. For the app’s usage statistics a statutory exemption applies for measuring the use of one’s own service with minor consequences for your privacy; you can always turn that measurement off.

2. Cookies on the website

Cookie	Purpose	Retention
`refinds_auth`	Crew only: keeps the signed-in session on the restricted environments. An ordinary visitor never receives this cookie.	7 days
`rf_merchant_session`	Shop owners and organisers only: keeps your signed-in session in the my.refinds portal.	30 days
`rf_claim_verify`	Confirms that you clicked the link in our email while taking over a listing.	15 minutes
`rf_claim_session`	Briefly holds your claim session after you arrived via the email.	30 minutes

All four are strictly necessary: without these cookies you cannot stay signed in or complete taking over a listing. The language you read the site in is part of the web address; no cookie is needed for that.

3. Local storage

On the website

Dismissed banner. If you dismiss the scrolling app tip, your browser remembers that for the duration of your visit (sessionStorage), so that the tip does not reappear on every following page. No identifier is stored and we receive nothing.

In the app

Your favourites, lists, day plans and recently viewed shops are stored in a database on your own device. As long as you do not share a list or plan, we do not receive that data. You erase it by deleting the app.
Your session token, if you are signed in, is stored in your device’s secure key storage (Keychain on iOS, Keystore on Android) — not in a cookie.
Your installation identifier for the usage statistics is stored in that same secure key storage — as is, when you turn it off, a second, short-lived key that holds the identifier to be deleted until the server confirms the deletion, and a separate switch that remembers whether you turned the statistics on or off. Your language and country setting are still set locally, but travel to our server — together with that identifier — as long as you have not turned off the usage statistics; see privacy statement §5.7.
How often you open each place is counted locally (only a count per place); only the most-opened place travels along with the statistics, and turning it off deletes the count.

4. What we do not use

No Google Analytics, Matomo, Plausible or comparable visitor analytics from third parties. Our own, first-party app statistics use a pseudonymous installation identifier — no name, no account, no cookie; see privacy statement §5.7.
No advertising cookies, no retargeting, no Facebook or TikTok pixel.
No social media embeds that load by themselves. Where we link to a social media profile, that is an ordinary link — nothing is loaded from that platform unless you click.
No A/B testing cookies.
No fonts from an external font service; fonts are served from our own server.

For the search page we record, per day, how often a search was performed and which filter combination was used (radius, type, category, and the shape of the date filter). That is an aggregated number per day; no IP address, session, cookie, coordinate, place name or calendar date is stored alongside it. The storage has no field for those.

The consequence is that we cannot tell whether two searches come from the same person — and that is precisely the intention. As a result a click is sometimes counted twice; we consider that a better trade than an identifier.

6. Maps and other external requests

As soon as you open a map, your browser or app fetches the map imagery directly from our map-imagery service — an external party that supplies the map tiles. That party sees your IP address and which map tiles you request — which is technically unavoidable. No cookie is placed and we pass nothing else on. Who that party is appears as a category in the sub-processor list; the name is available there on request. Where that party has its servers is for it to decide; please consult its own privacy statement for that. We do not store your IP address in this connection.

Beyond that, the site loads no third-party content.

7. Managing cookies

Because we place only strictly necessary cookies, there is nothing for you to accept or refuse. If you still want to clear them, do so through your browser settings. Bear in mind that you will then be signed out.

8. If this changes

If in future we place non-essential cookies — for visitor analytics, for example — we will ask for your consent in advance via a banner with categories, record that consent, and update this overview. Until then, the overview above is complete.

9. Questions

See Contact in the privacy statement.