Cookies and browser storage
Sign-in and security
NFA.run uses the first-party __Host-nfa_session cookie to recognise your session and protect account actions. It is sent only over HTTPS, is not readable by page scripts and uses SameSite=Lax. An authenticated session expires after 30 days without activity. Signing out ends that session; signing in again requires an email code and, for staff, an authenticator code.
Preferences on this device
Local storage saves your language (nfa.locale.v1), basket (mfa.cart.v1), favourites (mfa.favorites.v1), comparison (nfa.compare.v1) and recently viewed listings (nfa.recently-viewed.v1). These preferences stay in this browser until changed or cleared. They are not stock reservations and do not create paid orders.
Payment retry protection
The keys nfa.paypal.request.v1 and nfa.wallet.topup.v1 keep a request reference so a retry can reuse the same payment request. The site reuses these references for up to 14 minutes. They contain no payment-card number, email sign-in code or authenticator secret. A confirmed order and its money history are stored on the server, separately from browser preferences.
External services
Cloudflare processes network requests to deliver and protect the site and may use security cookies when applying protection. PayPal handles payment on its own pages under its own cookie notice. NFA.run does not currently embed advertising or audience-analytics counters. Server requests for exchange rates do not install a Yandex analytics counter in your browser.
Your controls
You can clear NFA.run cookies and site storage in your browser settings. This may sign you out and remove saved selections on this device, but it does not cancel paid orders or erase your server-side account. Blocking the sign-in cookie prevents account and checkout functions. For questions, use https://nfa.run/support or the contact in the privacy notice.
Cryptocurrency payments
Heleket also opens its own payment page. Its cookies and processing are governed by its own notice. No Heleket widget or tracking script is embedded on NFA.run.