Cookies and browser storage
Sign-in and security
NFA.run uses the first-party __Host-nfa_session cookie to recognise your session and protect account actions. It is sent only over HTTPS, is not readable by page scripts and uses SameSite=Lax. An authenticated session expires after 30 days without activity. Signing out ends that session; signing in again requires an email code and, for staff, an authenticator code.
Preferences on this device
Local storage saves your language, basket, favourites, comparison and recently viewed listings. These preferences stay in this browser until changed or cleared. They are not stock reservations and do not create paid orders.
Payment retry protection
The browser temporarily keeps a payment reference so retrying can reuse the same request. The site reuses these references for up to 14 minutes. They contain no payment-card number, email sign-in code or authenticator secret. A confirmed order and its money history are stored on the server, separately from browser preferences.
External services
Cloudflare processes network requests to deliver and protect the site and may use security cookies when applying protection. PayPal handles payment on its own pages under its own cookie notice. Server requests for exchange rates do not install a Yandex analytics counter in your browser.
Your controls
You can clear NFA.run cookies and site storage in your browser settings. This may sign you out and remove saved selections on this device, but it does not cancel paid orders or erase your server-side account. Blocking the sign-in cookie prevents account and checkout functions. For questions, use nfa.run/support or the contact in the privacy notice.
Cryptocurrency payments
Heleket also opens its own payment page. Its cookies and processing are governed by its own notice. No Heleket widget or tracking script is embedded on NFA.run.
Google Ads measurement
With your separate, voluntary consent, NFA.run uses Google Ads to match paid purchases to advertising. We send Google the order reference, payment time, actual amount paid excluding bonuses, currency, website source, available gclid/gbraid/wbraid advertising identifiers, measurement consent and denied personalization, and a SHA-256 fingerprint of the buyer’s normalized email when available. Email is hashed only on our server: this advertising integration never sends the plain address to Google or a browser tag. The hash is a matching identifier, not anonymous data. Names, telephone numbers, addresses, basket contents and details of the accounts sold are not sent.
Processing is based on your consent. Shopping and using the store do not depend on it. Without consent this advertising integration sends nothing, including the order event; no Google browser tag is loaded. Ad personalization is disabled. Your choice is stored in your browser for 180 days. Consented advertising identifiers are kept for no longer than 90 days from collection. The hash is stored encrypted only for delivery and retries, removed after Google accepts the live upload, and in all cases no later than that same 90-day limit.
Withdraw consent via Cookie settings → Essential only. The browser stops collection; once the server receives the withdrawal, it stops further uploads and deletes the stored hash and advertising identifiers for linked orders. If offline, withdrawal is retried when connectivity returns; account withdrawal takes effect after sign-in. A completed transmission cannot technically be undone; contact support about previously shared data. Store account and financial records are retained separately from advertising data. Google processes received information, including internationally, under policies.google.com/privacy and policies.google.com/technologies/partner-sites.
With valid consent, the Google tag on the paid order page receives only the server-computed email hash and purchase data. Automatic detection of contact details on the page is disabled. The hash is not stored in cookies or localStorage; the temporary page-memory copy is cleared after event processing, an error or leaving the page. Browser tag requests also expose the IP address, technical browser information, a sanitized page address and permitted advertising cookies to Google. If consent is declined the tag does not load; withdrawing consent after it has loaded reloads the page to stop its further operation.