Cookie Policy

1.About this policy

This document forms part of the EBCMX privacy notice and covers the whole of ebcmx.com: the public pages, the account dashboard, the trading terminal and the deposit and withdrawal flows. Where the privacy notice explains what we do with personal data, this one explains what is stored on the device you are reading from.

It covers cookies — small files your browser sends back to the site with every request — and browser storage, which stays on your device and is never sent anywhere. Most cookie policies cover only the first. Ours covers both, because the second sits on your device just the same and you have no ordinary way of seeing it.

It is written to be checkable rather than reassuring. Every item below exists in the running product, and this document is updated in the same change that adds, removes or repurposes one.

Some items are described by what they do rather than by their exact name. A cookie's name can identify the software that sets it, and we do not publish what EBCMX runs on; some storage names carry an internal project name that would tell you nothing. Where a name is ours and reveals nothing, we print it.

2.The cookies EBCMX sets

Every cookie below is set by EBCMX itself on ebcmx.com, and every one of them is there so that something you asked for works. None of them measures you, profiles you or follows you anywhere.

• Your session — set when you sign in and removed when you sign out. It is what an account depends on: without it a signed-in page cannot know that it is you. It expires on its own if you stop using it, and in any case at the ceiling we set on how long a single sign-in may last.
• Your sign-in challenge — set for a few minutes while you complete a second factor or a device check, and removed as soon as the sign-in resolves. It exists so that the step you are in the middle of survives the page you are on.
• NEXT_LOCALE — the language you chose, kept for about a year, so that a later visit does not send you somewhere else.
• ebcmx.balances.hidden — whether you asked for balances to be hidden on screen, kept for about a year. It holds one character, on or off, and no figure.
• ebcmx_device — a random identifier for the browser you signed in from, kept for about a year and signed so that it cannot be forged. It has its own paragraph below.

The device cookie is the one item in this list that is about you rather than about the page, so we state it in full. It is set when a sign-in succeeds — never while you are browsing anonymously — and it carries nothing but a random value we generated. We keep a one-way hash of that value against your account, together with details of the browser and of the connection the sign-in came from, so that we can show you the devices that have reached your account and let you remove one, and so that a browser you have used before is not treated as a stranger. Clearing it does not lock you out: your next sign-in simply looks like a new device.

One further cookie exists in the product but is not set today. When the device-approval check is switched on, a short-lived cookie carries a sign-in that is waiting for approval; it lives for minutes rather than months. We list it while it is switched off because a document that describes only the switched-on half of a product is one you cannot rely on the day the other half switches on.

3.What we keep in browser storage

Cookies travel to the server with every request. Browser storage does not: it stays on your device and is read only by the page you are looking at. Cookie policies conventionally stop at cookies, and ours does not, because every item below is on your device just the same and you have no ordinary way of seeing it.

Each item is described by what it holds:

• The interface you chose — light or dark.
• The markets you starred while signed out. Once you sign in, favourites are kept on your account instead, and the ones already on the device are merged in.
• Whether the markets page shows its miniature price charts.
• The markets you opened most recently, so that the market switcher can offer them first.
• How you arranged the trading screen — which panels sit where, and the chart interval you last used.
• Whether you asked us to stop showing the order confirmation step.
• Whether the side navigation is collapsed. Staff consoles keep their own separate copy of this.
• How many rows a history table shows.
• For the lifetime of a browser tab only: a note that a page has already tried reloading itself once after part of the site failed to download, so that it cannot loop; and, while you are approving a device from an emailed link, the approval token carried in that link.

None of this is a profile. Every item is either a setting you changed yourself or a note the page needs about itself, none of it is sent anywhere for measurement, and clearing your browser data removes all of it.

4.Why there is no cookie banner

You will not see a cookie banner on EBCMX, and that is not an oversight. A consent banner exists so that you can refuse the cookies that are not needed to deliver the service you asked for. We set none of those. Everything in this document is either strictly necessary for the site to work or a preference you set yourself and can unset the same way, so there is nothing to withhold consent from and nothing a banner could switch off.

If that ever changes — if EBCMX ever sets a cookie for measurement, advertising or any other purpose you did not ask for — the way to refuse it ships in the same change as the cookie, and this page says so before the cookie is set. We would rather write that sentence now, while it costs us nothing, than ask to be trusted on it later.

5.Cookies we do not set

EBCMX runs no analytics, no advertising and no tracking code of any kind. There is no analytics cookie, no advertising cookie, no cross-site identifier, no social plug-in and no comment widget, because none of that code is on the site to set one.

One honest qualification. A content-delivery and security layer sits in front of the site and sets its own operational cookies as part of doing that work — for example, to tell ordinary traffic from an automated attack. Those cookies belong to that provider and serve the delivery and security of the site. We do not read them, and they are not used by us for measurement or marketing.

The only third-party code that runs on our pages is the licensed charting library that draws the market chart on the trading terminal, and we serve it from our own domain. It is configured not to save its own settings into your browser.

6.Managing what is on your device

Every browser can list, block and delete cookies and site data, usually under its privacy or site settings. We do not reproduce the exact steps here: they differ by browser and by version, and a printed path is wrong the moment one of them changes.

If you clear it all, this is what happens. You are signed out and will sign in again. Your language, your interface, the markets you starred while signed out and your screen layout return to their defaults. Your browser stops being recognised, so your next sign-in looks like a new device to us. Nothing about your account, your balances, your orders or your history is affected — none of that lives in your browser.

Blocking cookies outright leaves the public pages readable and makes an account unusable: without the session cookie there is no way for a signed-in page to know that it is you.

7.Changes to this policy

We update this document when what is stored on your device changes — when an item is added, removed or repurposed — and the effective date at the top moves with it. There is no separate archive: the version in force is the one published here.

If you believe something is stored on your device that is not described here, write to support@ebcmx.com. We will either explain it or correct the document, and we will tell you which.