Cookie Policy

Last updated: July 28, 2026

This Cookie Policy explains how BouncyLoop SRL (“we”, “us”) uses cookies and similar browser-storage technologies (localStorage, IndexedDB) on spize.io. It is the extended notice referred to by our consent banner and complements the Privacy Policy. It is drafted to comply with the GDPR, the ePrivacy Directive (2002/58/EC), Article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and the guidelines of the Italian supervisory authority (Garante, 10 June 2021).

1. What cookies and similar technologies are

Cookies are small text files a website stores on your device. Related technologies — localStorage and IndexedDB — store data in your browser without sending it automatically to servers. We use both, sparingly. We set no advertising or cross-site tracking cookies of any kind, and no third party is allowed to set tracking cookies through our pages.

On your first visit, a banner lets you accept all, reject non-essential, or customize — with equal ease. Nothing non-essential runs before you opt in. Closing the banner with the × continues without consent (only strictly necessary storage is used).
Your choice is stored for 12 months (or until we materially change this policy, in which case we ask again). We will not re-prompt you before then.
You can change or withdraw your choice at any time — as easily as you gave it — with the button below or the “Cookie preferences” link in the footer. Withdrawing analytics consent stops collection immediately and deletes the analytics identifiers from your browser.

3. Strictly necessary storage (no consent required)

These are required to provide the service you request and are exempt from consent under Art. 122 of the Italian Privacy Code. Blocking them via your browser will break parts of Spize.

spize_consent — cookie, first-party, 12 months. Records the cookie choices you made in the banner, so we can respect them and not ask again.
spize.auth — localStorage, first-party, until sign-out. Your sign-in session token; keeps you signed in to your account.
Encryption keyring — IndexedDB, first-party, persistent. The local key vault that lets your dashboard decrypt the names of your own shares. It never leaves your browser — it is not readable by us.
Transient upload/download state — in-memory or short-lived browser storage used to run transfers you start (progress, resume data). Cleared when done.

4. Analytics storage (only with your consent)

If you opt in, our first-party analytics library sets a pseudonymous device identifier so we can understand how the product is used (pages viewed, features used, approximate device class) and improve it. Specifically:

ph_* identifiers — cookie + localStorage entries, first-party, up to 12 months. A random identifier and event-queue state for product analytics. Data is processed on our behalf by an analytics provider acting as our processor; it is not used for advertising, not combined with third-party data, and not shared for anyone else’s purposes. The identity of the provider is available on request (see the Privacy Policy, Section 6).

Additional privacy safeguards we apply to analytics:

URL fragments are stripped before capture — share-link decryption keys can never reach analytics;
the “Do Not Track” browser signal is respected;
nothing is initialised until you opt in, and opt-out takes effect immediately.

5. Advertising cookies

None. Sponsored placements that may appear on some pages are static, first-party images with a plain link — they involve no third-party ad scripts, no auctions, and no tracking cookies.

6. Third-party pages you may visit from Spize

Some flows hand you over to pages operated by others — for example the checkout and payout-onboarding pages of our payment processor, or a sign-in provider you choose. Cookies set there (including fraud-prevention cookies, which are typically strictly necessary) are governed by those operators’ own cookie and privacy policies.

7. Controlling cookies in your browser

Independently of our banner, you can block or delete cookies and site data in your browser settings (usually under “Privacy” — consult your browser’s help pages for Safari, Chrome, Firefox or Edge). Note that deleting site data for spize.io also removes your local encryption keyring: your shares remain safe, but your dashboard may lose the ability to show decrypted share names on that device unless you restore the vault backup by signing in with your password.

8. Changes and contact

If we change the cookies we use or their purposes in a material way, we will update this page and re-present the consent banner. Questions: info@spize.io. See also the Privacy Policy and Terms of Service.