Cookie Policy

1. The app and the website are different

Two surfaces, two stories. The Lebsloop mobile app does not use cookies — it keeps you signed in with your device's secure storage and uses a small set of SDKs (below). The marketing website, lebsloop.com, uses cookies. Wherever we say "cookies" in this policy, we mean cookies on the website and the equivalent SDKs in the app.

2. What cookies and SDKs are

Cookies are small files a website stores on your browser to remember things like that you are signed in, or your language. SDKs (software development kits) are code inside our app that do similar jobs — measuring how the app is used, sending push notifications, or reporting a crash. Pixels and local storage work the same way; we call them all "cookies" here for short.

3. The cookies and SDKs we use

Essential — always on

These make Lebsloop work, so we do not need your consent for them and you cannot switch them off in the app (you can block website cookies in your browser, but parts of the site will stop working). They keep you signed in, protect your session and checkout, guard against fraud and unauthorised access, and keep our infrastructure stable. On the app this is native secure storage and security SDKs; on the website, a session cookie and security tokens. Lifespan: per session, or short-term (up to 30 days).

Analytics — with your consent

These help us understand how Lebsloop is used so we can improve it — which screens are popular, where people drop off, whether a feature or campaign worked. The data is aggregated. We use PostHog for product analytics and Sentry for crash and error reporting; on the website, analytics cookies. We only set these after you consent, and you can withdraw consent at any time. Lifespan: up to 12 months (some analytics identifiers up to 24 months).

Functional — with your consent

These remember your choices — language and region, your saved filters and favourite brands and categories, and your notification preferences — and support our recommendation engine (see the Privacy Policy on automated decisions and AI). Lifespan: up to 12 months.

Marketing — with your consent

These measure our own marketing — which channel brought you to Lebsloop, and capping how often you see the same promotion. For ad measurement we may share a hashed email and phone with Meta, TikTok, and Google (see the Privacy Policy). We do not currently use cookies or advertising IDs to show you third-party ads across other apps or sites; if we ever do, we will update this policy and ask first where the law requires. Lifespan: up to 12 months.

4. Third-party providers

Some cookies and SDKs come from trusted providers who work on our instructions under data-processing agreements, and may not use the data for their own unrelated purposes:

• Mamo (payments — essential) — secures and processes payments; acts as its own controller for payment data under its own privacy notice.
• Our appointed courier partner (delivery — essential) — coordinates collection and delivery and keeps you updated.
• PostHog (analytics) — product-usage measurement.
• Sentry (crash and error reporting) — diagnoses bugs and crashes.
• Expo (push notifications — functional) — delivers in-app and push messages to your device.
• Meta, TikTok, Google (marketing measurement) — measure ad effectiveness using hashed identifiers (see the Privacy Policy).

5. Managing your choices

On lebsloop.com, the consent banner on your first visit lets you accept all, reject all non-essential, or choose by category; reopen it any time from "Cookie Settings" in the footer.

In the app, your analytics choice is asked on first launch; to change it later, write to privacy@lebsloop.com from your registered email. You can also manage app permissions — tracking, notifications, camera, photo library — in your device settings; on iOS, "Ask App Not to Track" limits identifier-based tracking, and on Android you can reset or limit your advertising ID.

6. How long cookies last

• Essential — per session, or up to 30 days.
• Analytics — up to 12 months (some identifiers up to 24 months).
• Functional — up to 12 months.
• Marketing — up to 12 months.

We review these regularly; lifespans may change as we update our technology or providers, and this policy will reflect our current practice.

7. Our legal basis

Under the UAE PDPL (and the GDPR where it applies), we need a lawful basis to use cookies. Essential cookies and SDKs rely on contractual necessity — they are needed to provide Lebsloop and complete your transactions. Analytics, functional, and marketing cookies rely on your consent, which we ask for before setting them and which you can withdraw as easily as you gave it, with no effect on processing already carried out.

8. International transfers, children, and your rights

Some cookie data may be processed outside the UAE under the safeguards described in the Privacy Policy (our infrastructure runs in AWS Frankfurt). Lebsloop is for adults — we do not knowingly collect data from anyone under 18 through cookies or otherwise. You have rights over cookie data (access, rectification, erasure, restriction, objection, and portability) — exercise them, or ask which specific providers we use, at privacy@lebsloop.com. Full detail is in the Privacy Policy.

9. Changes and contact

We may update this Cookie Policy as we add or change cookies, SDKs, or providers, or as the law changes; significant changes are notified in the app or on the website, and the effective date above reflects the current version. Questions? Write to privacy@lebsloop.com.