What this policy covers
This Cookie Policy explains how Boga Club (“Boga”, “we”) uses cookies and similar technologies — localStorage, sessionStorage, pixels and embedded frames — on www.bogaclub.com and our API at api.bogaclub.com. It is part of our Privacy Policy.
A cookie is a small text file a website stores in your browser. Local and session storage are browser features that let a site keep a value on your device without sending it with every request. A pixel is a tiny script or image that reports an event to a third party.
The cookies and storage we use
We keep this list deliberately short. Boga does not use advertising cookies inside the signed-in member app, does not run third-party ad networks on member pages, and does not sell or share cookie data for cross-context behavioral advertising.
Strictly necessary
| Name | Provider | Purpose | Duration |
|---|---|---|---|
boga_refresh | Boga Club (https://api.bogaclub.com) | Keeps you signed in. An httpOnly cookie that holds a one-time refresh token; it is used only to mint a short-lived access token and to sign you out. | Browser session, or 30 days with “Remember me” |
Access token (sessionStorage) | Boga Club | A 15-minute bearer token stored in your browser tab’s sessionStorage (not a cookie) so the app can call our API. Cleared when the tab closes. | 15 minutes / tab |
__stripe_mid, __stripe_sid | Stripe | Fraud prevention and checkout security when Stripe Checkout is the active payment provider. | 1 year / 30 minutes |
CardPointe hosted iFrame | Fiserv (CardPointe) | When CardPointe is the active payment provider, the card form is an iFrame served by Fiserv that tokenizes your card so card numbers never reach Boga Club. Fiserv may set its own security cookies inside that frame. | Session |
Functional (preferences)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
boga-theme-site, boga-theme-app | Boga Club | Remembers your light / dark theme choice per area of the site (localStorage, not a cookie). | Until you clear site data |
Analytics
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 | Aggregate usage statistics for our public marketing pages (visits, pages viewed, referrers). Loaded only on the marketing site and prelaunch page — never inside the signed-in member app. | Up to 2 years |
Advertising measurement
| Name | Provider | Purpose | Duration |
|---|---|---|---|
OpenAI ads pixel (oaiq) | OpenAI | Measures whether a visitor who arrived from one of our ads later joined the waitlist (a “lead_created” event). Loaded only on the marketing site and prelaunch page. We may also send the same conversion event server-side with a hashed identifier. | Set by OpenAI; see their policy |
Strictly necessary technologies
The sign-in cookie, the in-tab access token and the payment providers’ security cookies are required for the service to work: without them you cannot stay signed in, vote, post, or pay. They are set only when you sign in or start a checkout, are never used for advertising, and cannot be switched off in our settings. You can still delete them at any time by signing out or clearing your browser’s site data.
Analytics and advertising measurement
On our public marketing pages we use Google Analytics 4 to understand how visitors find and use the site, and the OpenAI ads pixel to measure whether our advertising leads to waitlist sign-ups. Both tags are mounted only by the marketing layout and the prelaunch landing page. They are not loaded on the member feed, voting, search, pitch, settings, checkout or admin pages.
These providers process the data under their own policies: Google and OpenAI. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on.
How to control cookies
You have several options:
- Browser settings. Every major browser lets you block or delete cookies and site data: Chrome, Firefox, Safari, Edge. Blocking the strictly necessary cookies will prevent you from signing in.
- Global Privacy Control. We treat a browser-level Global Privacy Control (GPC) signal as a request to opt out of any “sale” or “sharing” of personal information as those terms are defined by California law. Because we do not sell or share personal information, this has no practical effect today, but we honor the signal.
- Do Not Track. There is no industry standard for responding to “Do Not Track” signals, so we do not change our behavior in response to them, other than as described for GPC above.
Changes and contact
We will update this page whenever we add or remove a cookie or tracking technology and bump the “last updated” date above. Questions go to privacy@bogaclub.com.