Shapo · Legal & privacy עב
In effect from 8 October 2026 Version 1.2

Cookie & Storage Policy

This policy explains which cookies and which on-device storage Shapo uses, why, and how you can control them. It forms part of the Privacy Policy and the Terms of Use.

1. In short

  • We use no advertising cookies and no third-party analytics trackers. We do not sell or share data about your browsing for advertising.
  • The web app uses a small number of strictly necessary cookies (sign-in session, security, language) and browser storage for your preferences.
  • The native apps for iOS and Android use on-device storage for the same purposes, plus the operating system's secure store for sign-in tokens.

2. Cookies set by the web app

  • Sign-in cookie (.AspNetCore.Identity.Application). Keeps you signed in. Strictly necessary. Expires after 24 hours or when you sign out. Marked HttpOnly and SameSite=Lax, so scripts and other sites cannot read it.
  • External sign-in cookies (Identity.External, .AspNetCore.Correlation.*). Used only while a third-party sign-in is in progress, to complete the handshake securely; removed when it completes.
  • Anti-forgery cookie (.AspNetCore.Antiforgery.*). Protects forms against cross-site request forgery. Strictly necessary.
  • Language cookie (app_language). Remembers whether you chose Hebrew or English, so the page is served in your language from the first byte. Functional. Kept for one year.
  • Interactive session. The live connection between your browser and our server uses a connection identifier held in memory for the duration of the visit, not a persistent cookie.

3. Browser storage (localStorage)

The web app keeps the following in your browser's local storage. None of it is sent to third parties: your language, theme (light or dark), interface mode, whether you have seen the first-run tour, which version of the legal documents you accepted, the last number of orders you saw, and, in developer builds, the region you selected. You can clear all of it from your browser's site-data settings or from Settings → Storage → Clear All Cache. Clearing it resets preferences only; it does not delete your account or the data stored for it.

4. On-device storage in the native apps

  • App data. Your shopping lists, baskets, comparison reports, order records, saved addresses, plan settings and consent record are stored as files in the app's private sandbox on your device.
  • Secure store (iOS Keychain / Android Keystore). Your Shapo sign-in token; and, only if you chose to save them, a retailer's sign-in session token, a store login, or payment details you entered in the app's settings. The operating system encrypts them. They are removed when you delete your account from the app or uninstall it.
  • Catalogue database. A copy of the product catalogue — products, prices and images metadata, no personal data — downloaded from our server so that the app works quickly and offline.
  • In-app browser storage. When you open a retailer's site inside the app, that site sets its own cookies and storage inside the in-app browser, under the retailer's own policy. We do not read them, apart from a sign-in token you have explicitly asked us to keep for that store.

5. Requests to third parties

Loading the web app fetches fonts, icon and script libraries and map tiles from third-party content providers. Like any web server, those providers see your IP address and standard request headers; they do not receive your identity or account data from us. The native apps load the same fonts, icons and map tiles.

6. Your choices

Your browser lets you block or delete cookies and site data; blocking the strictly necessary cookies will prevent you from signing in. In the apps, Settings → Clear All Cache removes local data, and deleting your account removes everything tied to it (see Account & Data Deletion). Because we do not track you, we do not currently act on "Do Not Track" or Global Privacy Control signals — there is nothing to switch off.

7. Changes

We may update this policy as the Service changes. The version and effective date appear at the top of the page; the current version is always at https://shapo.store/legal/cookies. In case of any inconsistency between the Hebrew and English versions, the Hebrew version prevails.