Cookie Policy
Version: 1.1
Last updated: 11 October 2026
1. About This Policy
This policy explains how XPNNTL LTD, which operates Xpact ("Xpact", "we", "us", or "our"), stores and reads information on your device. It covers cookies, local storage, and session storage on xpact.app, in the Xpact dashboard, and in the Xpact mini app in Telegram.
A cookie is a small piece of text a website stores in your browser. Local storage keeps data on your device until it is deleted; session storage keeps it only until you close the tab or app.
For how we process personal data more generally, see our Privacy Policy. Contact us at support@xpact.app.
2. Categories
Strictly necessary
These items sign you in, keep the service secure, remember your cookie choice, or make a feature you asked for work. They do not need your consent, and the service may not work without them.
Preferences
These items remember how you like the dashboard: filters, sorting, search text, view, page size, the active category, and the sidebar. They are off until you allow them.
Analytics
These items let us measure how Xpact is used with PostHog, in its EU data region, and record how long you actively use the website while signed in. They are off until you allow them. Until you allow Analytics, or after you reject or withdraw it, we only count page views and feature use anonymously, without storing anything on your device.
Advertising
Xpact uses no advertising cookies, tracking pixels, session replay, or cross-site tracking.
3. Cookies
| Name | Purpose | Category | Lifetime |
|---|---|---|---|
xpact_consent | Records your cookie choice: which optional categories you allowed, the policy version, and when you chose. | Strictly necessary | 6 months |
auth_token | Keeps you signed in to the dashboard and protects pages that need an account. | Strictly necessary | 1 day |
sidebar_state | Remembers whether the dashboard sidebar is open or closed. | Preferences | 7 days |
All Xpact cookies are first-party and sent only to Xpact.
4. Local Storage
| Key | Purpose | Category | How long it stays |
|---|---|---|---|
auth_token, user_id, user_email, user_username, user_role | Sign you in to the dashboard and show your account. | Strictly necessary | Until you sign out; the sign-in itself expires after 24 hours |
xpactscr_locale, xpactscr_u<user-id>_locale | Remember the dashboard language. | Strictly necessary | Until changed or site data is cleared |
xpact.location.cached | Keeps the location you chose for Near me, its name, and when you chose it. | Strictly necessary for the feature you asked for | 7 days |
xpact.location.lastRadius | Remembers the distance you last chose for Near me. | Strictly necessary for the feature you asked for | Until changed or site data is cleared |
xpactscr_dash_filters_v3 | Remembers dashboard filters, which may include a location. | Preferences | 7 days |
xpactscr_dash_sort_v3 | Remembers dashboard sorting. | Preferences | 7 days |
xpactscr_dash_search | Remembers your latest dashboard search. | Preferences | 7 days |
xpactscr_dash_view_v2 | Remembers the table, cards, or map view. | Preferences | 7 days |
xpactscr_dash_per_page_v2 | Remembers how many lots are shown per page. | Preferences | 7 days |
xpactscr_active_category | Remembers the active category. | Preferences | Until changed or site data is cleared |
session_token | Links activity signals to your current session on the website. | Analytics | Until you sign out, withdraw consent, or clear site data |
ph_<project>_posthog | PostHog's random identifier for this browser and, once you sign in, your Xpact account number. | Analytics | Until you withdraw consent or clear site data; replaced when you sign out |
__ph_opt_in_out_<project> | Records that you allowed Analytics, so PostHog measures fully. | Analytics | Until you withdraw consent or clear site data |
The Near me items are stored only after you choose Near me and allow your browser or Telegram to share your location. They are not part of the cookie banner; you can remove them by clearing the saved location or your site data.
5. Session Storage
| Key | Purpose | Category | How long it stays |
|---|---|---|---|
xpact_tg_token | Keeps you signed in while the mini app is open. | Strictly necessary | Until you close the mini app |
xpact.launchLotOpened | Makes sure a lot you opened from a Telegram link opens only once. | Strictly necessary | Until you close the mini app |
xpact_tg_link_handled | Makes sure the mini app sends a code for connecting Telegram to your dashboard account only once. | Strictly necessary | Until you close the mini app |
xpact_legal_english_notice | Remembers that you closed the notice that our legal documents are in English. | Strictly necessary | Until you close the tab |
xpact_dashboard_recovery_at | Stops the dashboard from reloading in a loop if a sign-in is refused. | Strictly necessary | Until you close the tab |
ph_<project>_* | PostHog keys that follow the current visit and tell browser tabs apart. | Analytics | Until you close the tab or withdraw consent |
Telegram's own script, which runs the mini app inside Telegram, may store items of its own; Telegram describes them in its privacy policy.
6. The Telegram Mini App
The mini app keeps you signed in only while it is open and stores no preferences on your device; your feed settings are saved with your account instead. PostHog runs in the mini app without storing anything on your device. The only items the mini app keeps beyond your visit are the Near me items in section 4, if you use that feature.
7. Requests to Other Services
Some features load content from other services. These requests send your IP address and browser information to the provider, but Xpact sets no cookies for them:
- PostHog measurement requests go through Xpact's own address (
/ingest) and are forwarded to PostHog in the EU. PostHog keeps events for 12 months. - CARTO supplies map styles and tiles when a map loads.
- Lot images load from Xpact's image storage on Google Cloud.
- Auction operators' websites open when you follow a link to a lot's source; those websites may use their own cookies, which their policies explain.
8. Your Choices
When you first visit xpact.app, a banner asks whether you allow Preferences and Analytics. You can accept all, reject all, or choose each category in Settings; rejecting is as easy as accepting. Until you choose, optional items stay off, and you can use Xpact without choosing.
We keep your choice on your device for six months. After that, or when we publish a new version of this policy, we ask again.
You can change your choice at any time with Cookie settings in the site footer or in your account menu. When you withdraw a category, Xpact stops using it straight away and deletes the items it stored on your device.
You can also:
- sign out, which removes the sign-in items;
- clear the saved Near me location, or turn off location permission in your browser or Telegram;
- delete cookies and site data in your browser settings; or
- block storage in your browser, although signing in and some features may stop working.
9. Changes
We will update this policy when the items we store, their purposes, our providers, or how long items stay change. The current version and its "last updated" date are always on xpact.app.
10. Contact
XPNNTL LTD (trading as Xpact)
128 City Road, London, EC1V 2NX, United Kingdom
Email: support@xpact.app