Cookie Policy

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to website operators.

Similar technologies — such as local storage and session storage — serve comparable purposes and are covered by this policy.

We use cookies for the following purposes:

• Essential/strictly necessary: to operate the website, maintain your login session, and process secure payments. These cookies cannot be disabled.
• Functional: to remember your preferences (such as currency selection and locale) across visits.
• Analytics: to understand how visitors use the Service — for example, which pages are most popular. This helps us improve the experience for all users.
• Third-party services: some functionality on the site is provided by third parties who may set their own cookies. See section 4 below.

The cookies and browser storage Boatfront itself uses:

• __Secure-bf.session_token — Keeps you signed in. Set by our sign-in system and shared across Boatfront's subdomains. 7 days, renewed while you use the site, and removed when you sign out. Strictly necessary.
• __Secure-bf.session_data — A short-lived copy of your session, so pages load without a database lookup. 5 minutes. Strictly necessary.
• __Secure-bf.dont_remember — Set when you sign in without "remember me", so the session ends with your browser. Browser session. Strictly necessary.
• __Secure-bf.state — Protects the Google sign-in step against forgery. 5 minutes. Strictly necessary.
• bf-cookie-consent — Stores your cookie-banner choice (accepted or declined). 6 months. Strictly necessary.
• NEXT_LOCALE — Your language. Up to 1 year when you choose a language; otherwise until you close the browser. Functional.
• bf_active_broker — In the broker portal, the brokerage you are working as. 30 days. Strictly necessary for broker accounts.
• Local storage, set only when you ask for it: boatfront_currency (the display currency you choose, until you change it) and bf.pendingModelAlert (a model alert you asked for before signing in, 24 hours). Functional.
• Session storage, removed when you close the tab: boatfront_fx_rates (exchange rates for displaying prices, 6 hours) and bf-scroll-anchor (your place in a list when you go back). Functional.
• With your consent only: bf_attribution in session storage — which link or campaign brought you here, sent with an enquiry or sign-up so we know which channels work. Removed when you close the tab, or straight away if you withdraw consent.

The following third-party services used by Boatfront may set their own cookies or use similar tracking technologies:

• Google Analytics 4 (_ga, _ga_*) — Page-view and engagement statistics. Nothing from Google loads until you click "Accept"; advertising features are off. Up to 2 years, and deleted if you withdraw consent. See policies.google.com/privacy.
• Sentry — Error monitoring, through our own domain. When something breaks we receive a report, without cookies or your IP address. With your consent, Sentry also keeps a masked recording of the visit (session replay, in session storage as sentryReplaySession) so we can see what went wrong; text and form inputs are hidden. See sentry.io/privacy.
• Vercel Web Analytics and Speed Insights — Cookieless, aggregated statistics on page views and page speed, served from our own domain. Nothing that identifies you is stored on your device.
• Vercel BotID — Bot protection on forms such as sign-up and enquiries. Runs a check in your browser that tells people from automated scripts. Strictly necessary for security.
• Mapbox — Maps. Pages show a static map image; an interactive map loads only when you click "Show interactive map". Mapbox then stores an anonymous identifier in local storage (mapbox.eventData*), sends it usage events, and caches map tiles in your browser. See mapbox.com/legal/privacy.
• Algolia — Site search. Your search terms go to Algolia to return results; no cookies are set and click tracking is off. See algolia.com/policies/privacy.
• Stripe — Payments. Checkout happens on Stripe's own pages, which set Stripe's cookies there, not on Boatfront. See stripe.com/privacy.

We do not use advertising cookies or track you across third-party websites.

You can control or delete cookies at any time:

• Cookie settings: choose "Cookie settings" at the foot of any page to accept or decline again at any time. Declining switches Google Analytics off and deletes its cookies, stops session replay, and removes the attribution record. We ask again after six months.
• Browser settings: all modern browsers allow you to block, delete, or manage cookies. Consult your browser's help documentation for instructions.
• Opt-out tools: Google offers a Google Analytics Opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Please note that disabling strictly necessary cookies will prevent you from logging in or using certain features of the Service.

We may update this Cookie Policy from time to time to reflect changes in the technologies we use or our practices. The "last updated" date at the top of this page shows when it was last revised.

If you have questions about our use of cookies, please contact us at hello@boatfront.com.