Cookie Notice
Version 2026-10-14 · Effective October 14, 2026
This Notice explains how Kamirin (operated by AF Limited LLC) uses cookies and similar technologies on kamirin.com, and which third parties receive information when your browser loads our pages. It adds to our Privacy Policy, which covers personal information more generally.
1. The short version
In short: four sign-in cookies, Stripe's fraud cookies only when you open a payment form, fonts loaded from two outside services, and no tracking.
- We set four cookies. All four are strictly necessary to sign you in, keep you signed in, and verify your email address.
- Our payment processor, Stripe, sets its own fraud-prevention cookies — but only on our wallet page, and only once you open a form to add a card or buy Credit.
- Our pages load fonts from Google Fonts and Fontshare. Those requests set no cookies, but they do send your IP address to those providers.
- We use no analytics, advertising, social-media or cross-site tracking cookies, pixels or tags.
- Every cookie we set is needed for something you asked us to do, so we do not show a cookie banner.
2. What cookies and similar technologies are
A cookie is a small text file a website stores in your browser, which your browser sends back on later requests. Cookies set by the site you are visiting are first-party; cookies set by another company are third-party.
Similar technologies include scripts and requests that collect information from your browser or device — for example our payment processor's fraud-detection script, requests for fonts hosted by another company, and your browser's own storage.
3. Cookies we set (all strictly necessary)
In short: our four cookies hold security tokens that keep you signed in — not your details.
All four are set by Kamirin on kamirin.com and share the same protections:
- Host-only — your browser sends them only back to kamirin.com.
- HttpOnly — scripts running on the page cannot read them.
- SameSite=Lax, path
/— not sent on most requests originating from other websites. - Secure on our live site — sent only over HTTPS.
They contain security tokens. They do not contain your email address, your name or other profile details.
| Name | Purpose | Duration |
|---|---|---|
fr_access | Keeps you signed in. Holds a short-lived access token; the token inside expires after about 15 minutes and is renewed automatically. | 1 hour |
fr_refresh | Lets us renew your sign-in without asking for your password again, up to a session's 30-day limit. We store the matching token only as a one-way hash. | 30 days |
fr_2fa | Links the password step of signing in to the authenticator-code step. Set only while you are signing in. | 5 minutes |
fr_verify | Carries the email-verification challenge after you register, or when you sign in before confirming your address. | 30 minutes |
These are set when you register, sign in, or complete two-factor authentication, and refreshed as you move between pages. They are deleted when you sign out or delete your account, and also when a session can no longer be renewed — after 30 days, say, or if you signed that session out from another device. If you block them, you will not be able to sign in.
4. Font requests to other companies (no cookies)
In short: loading any of our pages sends your IP address to two font services.
Our pages load typefaces from two providers:
- Google Fonts (Google LLC) — fonts.googleapis.com, fonts.gstatic.com
- Fontshare (Indian Type Foundry) — api.fontshare.com
Each receives your IP address, your user-agent and the address of the page you are on. Our requests set no cookies. This happens on every page, including for visitors who are not signed in, and each provider handles that information under its own privacy policy. You can stop these requests with browser settings or an extension that blocks remote fonts; pages will then use a fallback typeface.
5. Stripe cookies and fraud detection
In short: Stripe's code loads only when you open a payment form, and then sets fraud cookies.
We use Stripe to process card payments for Kamirin Credit. Your browser loads Stripe's script (Stripe.js) from js.stripe.com only on our wallet page, and only once you open a form to add a card or buy Credit. It does not load merely because you opened a page, and it does not load on Board pages at all. Card details are typed into secure fields hosted by Stripe and do not reach our servers.
Once loaded, Stripe.js:
- sets cookies used to detect fraud — Stripe currently describes these as including
__stripe_mid(about 1 year) and__stripe_sid(about 30 minutes); and - collects information about your device, your browser and how you interact with the payment form, which Stripe uses — including across other websites that use Stripe — to detect and prevent fraud.
Stripe.js may also use your browser's storage for fraud prevention under Stripe's own policies. We do not use Stripe Link or other saved-wallet services.
Stripe is responsible for these cookies and this information under the Stripe Privacy Policy and Stripe Cookie Policy. We treat them as strictly necessary because they protect payments against fraud. If you block them, you may not be able to buy Credit.
6. Browser storage, and what we do not use
In short: one draft saved in your browser; no analytics, ads, session recording or CAPTCHA.
Browser storage we do use. When you write a Board but step away to buy Credit first, we keep that unsent draft — its title, details, category and amount — in your browser's session storage so it is still there when you come back. It is removed once the Board is posted, and your browser discards it when you close the tab. It never leaves your device until you post. On a shared computer, closing the tab clears it. We do not use local storage or IndexedDB.
What we do not use. We use none of the following:
- analytics or measurement tools (for example Google Analytics or Vercel Analytics);
- advertising, retargeting or social-media pixels or cookies;
- tag managers, session-recording or heat-mapping tools;
- error-tracking services;
- CAPTCHA or bot-detection services; or
- embedded third-party players or social widgets.
Links to Deliveries open on the Creator's own platform in a new tab, and that platform may set its own cookies once you are there. If we ever add a non-essential cookie or similar technology, we will update this Notice first and ask for your consent where the law requires it.
7. Do Not Track and Global Privacy Control
We do not track you across websites, and we do not sell or share personal information for advertising. A Do Not Track or Global Privacy Control signal therefore does not change any of the cookies described here. We treat a Global Privacy Control signal as a valid opt-out request, as described in our Privacy Policy.
8. How to control cookies
- Browser settings. Most browsers let you view, block and delete cookies, including third-party ones. Blocking our four cookies will stop you signing in; blocking Stripe's may stop you buying Credit.
- Signing out. Signing out deletes our sign-in cookies from your browser. You can also sign out of your other sessions from your account's security settings.
- Fonts. Browser settings or an extension that blocks remote fonts will stop the font requests in §4.
9. Changes and contact
We will update this Notice when the cookies or technologies we use change, and change the version and date above. Questions can be sent to privacy@kamirin.com.