Cookie and local storage policy

Necessary storage supports sign-in, security, language, requested preferences, and consent choices without optional tracking.

• tender_session — HTTP-only sign-in session, 1–14 days; default 5.
• tendrova_locale — selected language, 1 year.
• tendrova_consent — consent version/categories, up to 6 months before renewal.
• Firebase Auth IndexedDB/local storage — maintains requested sign-in.
• theme localStorage — selected appearance until changed or cleared.
• onboarding sessionStorage — temporary form draft until completion or session end.

With consent we may load Google Analytics 4. Consent Mode v2 starts analytics_storage as denied; basic mode prevents loading the Google tag before consent.

With separate consent we may load Google Ads and Meta Pixel for campaign measurement, remarketing, and personalized ads. ad_storage, ad_user_data, and ad_personalization start denied; Meta never loads first.

We do not send account identity, company name/profile, saved tenders, or card information to Google or Meta.

Checkout occurs on Stripe's domain, where Stripe may use necessary payment, security, and fraud-prevention storage under its own privacy policy.

Accept all, reject all, or enable analytics and advertising separately. Rejection does not limit core service. Cookie Settings remains available publicly and when signed in.

Withdrawal applies prospectively, stops new optional calls, and attempts to clear related first-party IDs. We ask again after material changes or no later than six months.