Cookie Policy

Operated by: PXL NexQuantum Ltd, Republic of Cyprus (EU)
Applies to: Everyone who visits yunoh.com or uses the Platform, including Guests

A cookie is a small file a website asks your browser to store and reads back when you return. Local storage, session storage and IndexedDB keep information in your browser in a similar way, and session storage is cleared when you close the tab. "Cookies" here covers all of these, and reading characteristics of your device too: the rules bite on storing something on your device or reading from it, whatever the technology.

This policy sits alongside the Privacy Policy. Yunoh runs no advertising cookies, and no analytics technology on your device. We operate no advertising, retargeting or attribution pixels, store nothing on your device for partner or referral tracking, and share no data with advertising networks. If that changes, we will update this policy and ask for your consent first.

We use three categories: strictly necessary items; preferences you chose, which we keep as strictly necessary; and one optional item, the free-minutes device check, which runs only if you say OK.

2. What we store, and why

Strictly necessary

Name	Type and set by	Purpose	How long
`yunoh_18`	Cookie; Yunoh	Remembers your 18+ entry declaration	30 days
`yunoh_18`, `yunoh.ageConfirmed`	Local storage; Yunoh	The same declaration, and the time you confirmed	Until you clear site data
`yunoh.cookieConsent`	Local storage; Yunoh	Your cookie choice, the policy version shown and the time	12 months, or until this policy changes; then we ask again
`firebaseLocalStorageDb` (`firebase:authUser:*`)	IndexedDB, or local or session storage if IndexedDB is unavailable; Google Firebase, for Yunoh	Keeps you signed in, Guests included, because a Guest session is an anonymous sign-in. The landing and legal pages may create this database empty when they check whether you are signed in	Until you sign out; the empty database, until you clear site data
`yunoh.device`	Local storage, sent as the header `X-Yunoh-Device`; Yunoh	A one-way hash of device characteristics that protects signed-in Accounts against takeover and ban evasion. Never set for Guests	Until you clear site data
`yunoh:matching-session-id`, `yunoh.enteredRooms`	Session storage; Yunoh	Holds your place in matching in one tab, and stops a reloaded tab rejoining a call you left	Until you close the tab
`billing:warn:`, `billing:final:`	Session storage; Yunoh	Keeps a paid call's low-balance warnings in view if the page reloads during the call	Until the call ends or you close the tab
`yunoh:rtdb-reloaded`	Session storage; Yunoh	Records that the page reloaded once by itself to repair the live connection, so that it does not reload in a loop; holds no personal data	Until you close the tab
`firebase:previous_websocket_failure`, `firebase:host:*`	Local storage; Google Firebase	How and where to connect to our real-time service	Removed by the software when no longer needed
`firebase-app-check-database`, Google reCAPTCHA Enterprise	IndexedDB and Google's own cookies; Google	Bot protection on the sign-up and Guest pages: assesses the request from device and browser signals and your IP address and returns a risk signal; a request may be blocked or challenged automatically. reCAPTCHA is governed also by Google's Privacy Policy and Terms of Service	Renewed automatically; as Google sets them
`firebase-heartbeat-database`	IndexedDB; Google Firebase, as part of the sign-in software	Holds dates and the software version and no identifier; Google uses it to measure use of its software	Kept by the software
`__cf_bm`, `cf_clearance`	Cookies; Cloudflare	Bot management, set only if our security provider's bot protection is active	About 30 minutes; up to 12 months

Preferences you chose (strictly necessary)

Name	Type	Purpose	How long
`yunoh_lang`, `yunoh_i18n_mt_<lang>`	Local storage	Your interface language, stored only when you pick one or arrive by a link that sets it, and the translations already fetched for it	Until you clear site data
`yunoh.mediaPrefs`, `yunoh.call.filter`, `yunoh.stickers.recent`	Local storage	Your camera and microphone and whether each is on, your video look, your recent stickers	Until you clear site data
`yunoh.settings`, `yunoh.favFriends`, `yunoh.crypto.checkout`, `yunoh.verifySkipped.<uid>`, `yunoh.sessionHint`	Local storage	A copy of your app settings, your starred friends, your crypto checkout choices, your choice to skip the verify-email screen, and which first screen to show while sign-in loads	Until you sign out
`yunoh.mediaPreview.opened`, `yunoh_i18n_fallback_off`	Session storage	That your camera preview opened in this tab; that translation is unavailable, so it is not asked for again	Until you close the tab
`/sw.js`	Service worker	Registered when you visit the home page or `/web-app`: lets you add Yunoh to your home screen and, if you turned notifications on, shows them; caches nothing	Until you remove it or clear site data
Push subscription, `firebase-messaging-database`, `firebase-installations-database`, `yunoh.pushUid`	Your browser's push service; IndexedDB; local storage; your browser maker and Google Firebase, for Yunoh	Only if you turn notifications on in this browser: the push subscription, the push token record, an installation id sent to Google, and which account turned notifications on. Notifications are off until you turn them on, and the lock-screen text shows no names unless you turn on "Show names in notifications"	The push subscription: until you turn notifications off, sign out, or clear site data. `firebase-messaging-database` and `yunoh.pushUid`: until you turn notifications off or sign out. `firebase-installations-database`: until you turn notifications off or clear site data

Optional, asked first

Name	Type	Purpose	How long
Free-minutes device check	A read of device and browser characteristics; nothing is stored on your device	Keeps a Guest's five free minutes to once per person, and carries a ban across if a Guest creates an Account	Nothing stored on your device; your choice is kept in `yunoh.cookieConsent`. On our servers, a coded (hashed) record of the result is kept for 90 days after your last free-minutes session

No age-check result is stored on your device. The 18+ entry declaration does not open the service in a gate country: whether it opens after the age gate is decided on our servers, so clearing anything on your device neither opens the service nor avoids the check.

Staff tools set their own security items on the staff console, a separate site, and none on the Platform's pages. Card checkout, when used, runs on the pages of our payment processors, Xoala and Undercover Payments (Axiome Payments), which set their own cookies there under their own notices.

Counting visits uses no cookie and nothing on your device. Separately from everything in the tables, we count how many times our pages are opened, and how many visits lead to an action such as starting the Guest free minutes or opening sign up or sign in, as anonymous daily totals. Nothing is stored on or read from your device for this, so it is not a cookie, it is not in the consent banner, and refusing cookies does not change it. We keep no IP address, device identifier or browser details with these totals; your IP address is used only for a moment, in our server's memory, to block abuse. The Privacy Policy gives the basis.

One item never carries two consent statuses. A purpose needing your consent has its own item, run only after you consent, and nothing set for a strictly necessary purpose is used for it. That is why the device signal for signed-in Accounts and the free-minutes device check for Guests are kept apart.

Third-party technologies are governed by the third party's own notice too. A Processor may use the data only for us; a recipient acting as an independent controller applies its own notice to that use. We do not allow a Processor to process personal data in production unless it is engaged under a written data-processing agreement meeting the requirements of Article 28. International transfers: section 10 of the Privacy Policy.

3. The legal basis

Two regimes apply; where they differ we apply the stricter everywhere.

Cyprus, the EU and the EEA. The ePrivacy Directive 2002/58/EC as transposed (in Cyprus, Law 112(I)/2004), with the GDPR governing what follows. Anything that is not strictly necessary needs your consent. Regulator: the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

The United Kingdom. The Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), as amended by the Data (Use and Access) Act 2025, whose main data-protection provisions commenced 5 February 2026. Regulation 6 requires consent before anything is stored on or read from your device; regulation 6(4) is the strictly-necessary exception our strictly necessary items, including the preferences you chose, rest on. Regulator: the Information Commissioner's Office.

The Act also introduced new PECR exceptions for certain statistical and service-improvement purposes. We do not rely on them: we run no analytics technology on your device, and the one optional item is asked for first. The visit counting in section 2 stores and reads nothing on your device, so these rules do not reach it.

Strictly necessary items rest on Article 6(1)(b) and 6(1)(f) GDPR. The free-minutes device check rests on your consent under Article 6(1)(a).

4. Your choices

On your first visit to an app page, in any market, a consent banner appears unless you have a choice that is still valid. It explains the free-minutes device check and why we use it; gives "Accept all" and "Reject all" equal prominence, with no pre-ticked boxes and no nudging; offers "Manage preferences", with one toggle for the device check, off until you turn it on; links to this policy; treats closing or ignoring it as no consent; and records your choice, the time and the policy version shown. If you have not said OK when you start the Guest free minutes, we ask first in a short prompt. We ask again after 12 months, or sooner if this policy changes.

Strictly necessary items, including the preferences you chose, are stored whatever you choose: the Platform cannot give you what you asked for without them.

Withdrawing consent is as easy as giving it. Open Cookie preferences in the footer of any page or in your account settings, turn the device check off and save: it takes effect at once, and no further check is made. The coded record of an earlier check stays on our servers only for the rest of its 90 days, so that the free minutes cannot be claimed again, and is then deleted. Browsers also block or delete site data, though deleting ours deletes your consent record, signs you out and forgets your preferences. We treat a Global Privacy Control signal as a no to the device check and do not show the banner on our own; you can still turn the check on yourself. Withdrawal does not affect the lawfulness of anything done while consent was in force.

What refusing costs you. Refusing the free-minutes device check means no Guest free minutes. You can still create an Account, a new Member still receives the 15 signup Matchsticks, and nothing else changes. Blocking strictly necessary items means the Platform will not work properly. Refusing never changes the price of Matchsticks.

The consent banner is not the entry check. The identity verification at the age gate comes first, cannot be declined in Cookie preferences, and no cookie choice satisfies or avoids it.

5. Changes to this policy

We update this policy when the technologies we use change. When this policy changes, we ask for your cookie choice again, and we add any new item to section 2 before it is used.

Contact

Anything involving a child: childsafety@yunoh.com (treated as immediate at any hour)
Removal of a non-consensual intimate image: ncii@yunoh.com (the depiction is removed within 48 hours of a valid request)
Refunds, cancellation and the right of withdrawal from a purchase: refund@yunoh.com
Data protection, data subject requests and privacy rights: privacy@yunoh.com
Law enforcement, government and regulator requests, and intellectual property notices: legal@yunoh.com
Account, billing other than refunds, payouts, safety reports, complaints and appeals: support@yunoh.com
General enquiries: info@yunoh.com
Telephone: there is no telephone support. Support is by email and by support chat in the app.
Post: PXL NexQuantum Ltd, Voukourestiou 25, Neptune House, 1st floor, Flat/Office 11, Zakaki, 3045 Limassol, Republic of Cyprus
Company registration number: HE 497211

You may complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the supervisory authority where you live. In the United Kingdom, PECR is enforced by the Information Commissioner's Office (www.ico.org.uk), to which you may complain directly, without raising it with us first. Questions about your data come to us in Cyprus at privacy@yunoh.com.