Skip to content
Garisea

Cookie Policy

Last updated: July 15, 2026

1. Introduction

This Cookie Policy explains what cookies and similar tracking technologies Garisea uses, what each one does, how long they last, and how you can control them. It applies to the Garisea web surfaces ( garisea.com and dealer.garisea.com) and to the equivalent local storage used by the Garisea mobile apps for iOS and Android. For the broader picture of how we handle personal information, see our Privacy Policy.

2. What Are Cookies

A cookie is a small text file a website places on your device to remember something between visits — your login session, your preferred theme, your last-viewed location. The mobile app uses equivalent on-device storage mechanisms (Keychain, Keystore, SharedPreferences, Hive boxes) that serve the same purposes; we'll cover those in Section 7.

We group the storage we use into four areas: essential, preference, analytics, and advertising/third-party. Essential storage can't be disabled. Advertising is off unless you turn it on in the cookie consent banner. First-party analytics (Section 5) runs by default to help us improve Garisea and can be switched off at any time in your account settings.

3. Essential Cookies

These cookies are strictly necessary for Garisea to work. Without them, you can't sign in, submit a form, or stay authenticated across pages. They cannot be disabled.

CookiePurposeLifetime
access_tokenAuthenticates your session for in-app requests. HttpOnly + Secure + SameSite=Lax.30 minutes
refresh_tokenAllows your session to be refreshed without re-entering your password. Rotated on every use.30 days
garisea_csrfCSRF protection token for state-changing requests.Session
cf_*Bot mitigation + DDoS protection tokens set by our security provider.30 minutes
cookie_consentRemembers your cookie preferences so the banner doesn't reappear.1 year

4. Preference Cookies

These remember choices you've made so we can present the experience the way you like it. You can clear them anytime from your browser; the only effect is that Garisea will reset to its defaults.

Cookie / StoragePurposeLifetime
themeLight / dark / system theme preference.1 year
last_locationYour last-selected browse location (e.g. Nairobi) so search defaults sensibly.90 days
currencyDisplay currency (KES default).1 year
languageUI language (currently English-only).1 year

5. Analytics (Usage Data)

We use privacy-preserving, first-party usage analytics to understand how the marketplace is used — which cars and features are useful, where things break, and how to improve search and recommendations. This is our own analytics, not a third-party advertising tracker.

Legal basis and default. We collect this usage data under our legitimate interest in operating and improving Garisea, so it is on by default. To do this we store a first-party identifier on your device (in your browser's local storage on the web, and in on-device storage in the mobile app) that lets us distinguish visitors and connect the steps of a browsing session.

What it is not. This data is aggregated to improve the product. It is never sold, never used to advertise to you or for cross-app tracking, and never used to personally identify you. IP addresses are not stored with it in a personally identifying way.

Your control (opt-out). You can turn usage analytics off at any time — it takes effect immediately and removes the on-device identifier:

  • On the web — go to Profile → Settings and switch off “Share anonymous usage data”.
  • In the mobile app — go to Profile → Privacy & Data and switch off “Share usage data”.

6. Third-Party Cookies and Embedded Content

Some features depend on third-party services that set their own cookies in your browser. We don't control these cookies — they fall under each provider's privacy policy.

  • Meta Pixel (advertising & measurement) — set only if you turn on the Advertisingcategory in our cookie banner (off by default). It lets us measure and optimise Garisea's own ads on Facebook and Instagram and show them to people who have visited Garisea; it does not let other companies advertise to you. See Section 6.4 of our Privacy Policy. You can withdraw consent any time in the cookie banner.
  • Bot mitigation / DDoS protection — security cookies set automatically when you load any garisea.com page; required for the site to function safely.
  • Image and video CDN — when vehicle photos and videos load, the media CDN may set minimal caching cookies. No personal data is shared with it.
  • Maps and location autocomplete — when a map renders (e.g. on the viewing-location picker), the maps provider sets its own cookies.
  • Payment processing— when a dealer is redirected to our payment provider's checkout page to top up the wallet, the provider sets its own session cookies. These cookies are scoped to the provider's domain and never reach garisea.com.

7. Mobile App Storage (iOS and Android)

The Garisea mobile app doesn't use HTTP cookies — those are a browser concept. Instead it uses on-device storage primitives that serve the same purposes. Here's the full inventory:

StoragePurposeEncrypted by OS?
iOS Keychain / Android KeystoreAuthentication tokens (access + refresh). Excluded from device backup.Yes (hardware-backed where available)
SharedPreferences / UserDefaultsUser preferences: theme, language, last-viewed location, notification toggles.No (sandboxed to the app)
Hive boxes (Flutter local DB)Recently-viewed vehicles, search history, saved-for-offline favourites.No (sandboxed to the app)
Image cacheCached vehicle photos for faster scrolling and offline browsing.No (excluded from cloud backup)
Push notification identifierPer-install identifier issued by the push notification provider so alerts reach your device.N/A (managed by the push provider)
Crash-monitoring breadcrumbsLast 100 in-app actions (taps, navigation) used to attach context to a crash if one occurs. Sent only if a crash is captured.No (in-memory until crash)

On iOS, the Advertising Identifier (IDFA) is collected onlyif you grant App Tracking Transparency consent on first launch. We default to off. When granted, it is shared with our advertising partners (Meta and Google) to attribute app installs and measure Garisea's own ads — see Section 6.4 of our Privacy Policy.

Clearing app data from your device's OS settings removes everything except the push-provider installation identifier (which regenerates on next launch). Uninstalling the app removes everything, including tokens — you'll need to sign in again next time you install.

8. Managing Your Preferences

You can manage your choices in a few places:

  • Usage analytics — on by default, and you can turn it off any time. On the web, Profile → Settings → “Share anonymous usage data”. In the mobile app, Profile → Privacy & Data → “Share usage data”.
  • Advertising— off unless you turn it on in the cookie consent banner shown on your first visit; look for the “Cookie settings” link in the website footer to change it later.
  • In your browser— Chrome, Safari, Firefox, and Edge all let you view, block, and delete cookies per site. Search your browser's help for “manage cookies” — the exact path varies.
  • In the mobile app — go to Profile → Notification Preferences to manage push notifications. For App Tracking Transparency (iOS only), use Settings → Privacy & Security → Tracking on your device.

Disabling essential cookies will break authentication and key features. Turning off usage analytics has no functional impact — you'll just be less visible to us in aggregate metrics.

9. Do Not Track and Global Privacy Control

You have a direct, specific control for usage analytics in your account settings (Section 5), and advertising stays off unless you opt in. Because those in-product controls give you a clear choice, we rely on them rather than the browser-level “Do Not Track” or Global Privacy Control (GPC) signals, which are inconsistently defined and not legally required in the markets we serve. If that changes for a region we operate in, we'll update this policy and honor the applicable signal.

10. Changes to This Cookie Policy

We may update this Cookie Policy as we add or remove third-party services, change retention periods, or align with new regulations. Material changes will be communicated via a banner on the website and an email to your account if you have one. The “Last updated” date reflects the most recent revision.

11. Contact

For cookie-related questions, contact [email protected].