Cookies and local storage
Operator: Mathematricks FZC · Office - C1 - 1F - SF11592 Ajman Free Zone C1 Building Zone Free Ajman, United Arab Emirates
Updated: 2026-11-03 · [email protected]
Application cookies
The app uses hmhm_private to maintain a signed-in session and hmhm_guest to recognize an anonymous browser. These cookies are HttpOnly and SameSite=Lax; Secure is set on HTTPS. Signed-in sessions have a seven-day cookie lifetime. Saved logins survive application restarts; signing out or resetting a password revokes the relevant saved login sessions. The guest cookie is configured with a one-year lifetime.
Guest trials are limited to one session per UTC calendar day, including sessions ended early. We use an anonymous browser cookie and keyed hashes of the connection IP address combined with browser information to reduce repeat trials after cookies are cleared. Raw IP addresses are not stored in this trial ledger. We record limited browser, platform, language and reported time-zone information; recent trial records are pruned during new admissions after seven days. We cannot access IMEI, a verified hardware device ID or your device name. These signals are not proof of a unique person, and matching browsers on a shared connection may be treated as the same visitor.
Sign-in, payment and browser permissions
Optional sign-in uses a short-lived authorization flow and a temporary authorization cookie. Sign-in and payment providers can use their own cookies or similar technology when you visit their pages. Their services have separate privacy information.
Microphone and camera access are browser permissions, separate from analytics cookies. Disabling optional analytics does not disable sign-in, payment processing or necessary allowance checks. The final storage inventory and consent treatment must be reviewed for the launch countries.
Invitations and affiliate attribution
When you enter and validate an invitation code, the current invitation flow saves it in a session cookie named hmhm_ref so it can be applied after sign-in or registration. This supports the invitation you requested; it is separate from optional analytics. Closing the browser session can remove this cookie before redemption.
The older explicit referral-tracking flow can create a 30-day referral cookie. After attribution or redemption, an account-level referral and commission record can remain beyond the cookie’s lifetime for accounting and abuse prevention. Affiliates receive totals rather than private conversation contents. The final retention schedule must cover these records too.
Optional analytics storage
After analytics acceptance, public-site analytics may set _ga cookies on public pages, configured with a 90-day cookie lifetime. HMHM stores your analytics choice and a random analytics browser identifier in local storage; a visit identifier, reviewed campaign codes and temporary registration/login flags use session storage. These are separate from the cookies required for sign-in and usage allowances.
Declining analytics does not stop you using the app. Withdrawing through Analytics preferences stops future usage events, clears HMHM analytics identifiers and removes accessible _ga cookies. It does not delete analytics data already received by a provider. Localhost and developer review pages are excluded from collection.