This Cookie Policy explains how EB Financial Holdings, LLC ("PrettyFace", "we", "us") uses cookies and similar technologies (such as your browser's local storage) on our website and Service. It is part of our Privacy Policy.
1. What are cookies?
Cookies are small text files a website stores in your browser. Local storage is a similar store that stays in your browser and is not sent to us with every request.
2. Who is asked, and what your choice changes
If you visit from the European Union, the European Economic Area (Iceland, Liechtenstein, Norway) or the United Kingdom, a small banner at the bottom of the page asks for your choice. We recognise the country from the network address our security provider, Cloudflare, reports for your connection; we do not keep that address to do so.
- Until you choose, and if you choose Reject: Google Analytics is not loaded, and our own first-visit cookies (section 3.3) and the partner cookie (section 3.4) are not set, so nothing about where you came from is kept in your browser. The strictly necessary and functional items in sections 3.1 and 3.2 keep working: signing in, the age check, your language, and our security checks.
- If you choose Accept: Google Analytics loads, we keep where your first visit came from (section 3.3), and a partner link you came through is credited (section 3.4).
- If you change Accept to Reject later: Google Analytics stops at once and its cookies are deleted from your browser; our first-visit cookie is deleted and the visit we stored is removed, unless it was already attached to an account you created; and the partner cookie is removed.
If you visit from anywhere else, no banner is shown, and the analytics in section 3.3 and the partner cookie in section 3.4 are used by default. Everywhere, our own first-visit record is not made when your browser sends a Do Not Track or Global Privacy Control signal.
3. What we use
3.1 Strictly necessary
These are needed for the Service to work and are always set.
- authjs.session-token (or __Secure-authjs.session-token) — keeps you signed in. 30 days.
- authjs.csrf-token, authjs.callback-url, and during Google, Discord or X sign-in authjs.state, authjs.pkce.code_verifier, authjs.nonce — protect the sign-in itself. Until you close the browser, or 15 minutes.
- pf_consent — your cookie choice (EU/EEA/UK only). 12 months.
- pretty_anon_age_verified, pretty_adult_consent — you confirmed you are 18+ and chose adult content before signing in. 12 months.
- pf_agv_state — only while an age check with our verification provider is in progress. 15 minutes.
- pretty_anon_session — a chat started without an account. 7 days.
- harmony_visitor — which account last signed in on this browser, used to detect self-referral and repeat-account abuse of our partner programme. 12 months.
- qa_gate — only while the site is behind a password. 30 days.
- Cloudflare security cookies (for example __cf_bm) and, when you sign in with email, the Cloudflare Turnstile human check.
- Local storage pf_age_ok_v1 — you confirmed 18+ on a page that asks.
3.2 Functional
These remember what you chose so the site works the way you set it. They are always set.
- NEXT_LOCALE — your language. 12 months.
- pf_category — the category you picked (for example Women or Men). 60 days.
- pf_pages — the collection pages you have opened, so they show as shortcuts above the categories. 30 days.
- pf_feed_id — a random number that keeps the order of your feed when you are not signed in. 6 weeks.
- harmony_onboard — the first-run setup. 1 hour.
- Local storage for your settings and what you have already seen: sound and autoplay, microphone and speaker, text size, call ring, hints you have dismissed, chats you have read, and whether the install-app prompt was shown.
3.3 Analytics (EU/EEA/UK: only after Accept)
- Google Analytics 4 (Google LLC) — cookies _ga and _ga_<id>, 2 years. It records the pages you view and the actions you take, your device type and approximate location. We send no names or email addresses; when you are signed in we send our own internal account number so visits on different devices can be counted once.
- pf_attr (12 months) — where your first visit came from: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the name of the site that sent you (never the full address or search words), the first page you opened (never its query; in the EU/EEA/UK, the page where you chose Accept), your country, your device type (phone, tablet or computer) and a random number. It holds no IP address and no browser details. We store the same visit in our database, and if you create an account it is attached to it.
- pf_vn (30 days) — tells the page to send that first visit to us once; it is removed as soon as it has been sent.
3.4 Partner links
- harmony_aff — set when you open a partner's link to PrettyFace, so that partner can be credited if you sign up or pay. In the EU/EEA/UK it is set only after you choose Accept (until then the link carries the click's number, pf_aff, to the first page you open), lasts at most 13 months, and is removed if you choose Reject. Elsewhere it lasts as long as that partner's agreement with us provides, up to 10 years.
- When you open a partner's link we record the click, with your network address and browser details, to count it for the partner and to prevent fraud.
3.5 Advertising
PrettyFace does not use advertising cookies and does not share your data with advertising networks. If this changes, we will update this policy and ask where the law requires.
4. Third parties
- Google — Google Analytics (section 3.3) and Google sign-in. Where we offer Google sign-in, Google's own sign-in script loads and Google may use its own cookies, under Google's cookie policy.
- Cloudflare — security, bot protection and the Turnstile check.
- Payment processors — when you pay, the provider's checkout page (on its own domain) sets its own cookies.
5. Managing your choices
- Our banner (EU/EEA/UK) — Accept or Reject, both equally easy. Change your choice at any time with Cookie settings in the footer of our pages, or the link in section 2.
- Do Not Track / Global Privacy Control — we honour both for our own first-visit record, everywhere.
- Your browser — you can view and delete cookies and local storage. Blocking strictly necessary cookies will break parts of the Service, such as signing in.
6. Changes to this policy
We update this Cookie Policy when what we use changes. The "Last updated" date shows the current version.
7. Contact
Questions about cookies? Email [email protected].