Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your computer, phone, or other device when you visit a website. They are widely used to make websites work, to make them work more efficiently, and to provide information to the owners of the site.

We also use other tracking technologies that operate in a similar way, including:

• Web beacons / pixel tags: tiny graphic images embedded in web pages and emails that record whether you accessed certain content.
• Local storage and session storage: mechanisms used by your browser to store data locally on your device.
• Software development kits (SDKs): code embedded in our mobile application that performs functions similar to cookies, including the use of mobile advertising identifiers (such as Apple's IDFA and Google's GAID), device identifiers, push notification tokens, and secure on-device storage.

In this Policy, we use the term "cookies" to refer to cookies and all of the technologies listed above, unless we state otherwise.

2. Cookies on Our Website and Web Application

The cookies we use on the Site and our web application fall into the following categories.

A. Strictly Necessary Cookies

These cookies are essential to provide you with services available through our Site and to enable you to use some of its features. Without these cookies, the Services that you have asked for cannot be provided. We rely on our legitimate interest (and, where applicable, the necessity of performing a contract with you) to set these cookies; they do not require your consent.

Examples include:

• Authentication cookies (such as partner_token) that keep you signed in to your account or partner portal.
• Security cookies that help us detect and prevent fraud, abuse, and unauthorized access.
• Load-balancing and infrastructure cookies set by our hosting and CDN providers (such as Vercel and Cloudflare) to deliver the Site reliably.
• Consent-state cookies that remember your cookie preferences so we do not ask you again on every page.

B. Performance and Analytics Cookies

These cookies collect information about how visitors use our Site, for example which pages they go to most often and whether they receive error messages. We use this information to improve how our Site works and to understand product usage. Where required by law, we ask for your consent before setting these cookies.

Examples include:

• Google Analytics – measures aggregated traffic, sessions, and page performance. Learn more at Google's policies. You can opt out via the Google Analytics Opt-out Browser Add-on.
• Product and error monitoring tools we may use from time to time to identify performance issues, crashes, and broken flows.

C. Functional Cookies

These cookies allow our Site to remember choices you make (such as your preferred language, region, theme, or wallet connection) and provide enhanced, more personal features. Where required by law, we ask for your consent before setting these cookies.

Examples include:

• Theme preference (light / dark mode).
• Wallet connection state for our web application.
• Preferred currency, language, or region settings.

D. Targeting and Advertising Cookies

These cookies are used to deliver advertisements that are more relevant to you and your interests, to limit how often you see an advert, and to help measure the effectiveness of advertising campaigns. They are usually placed by advertising networks with our permission. We set these cookies only with your consent where required by law.

Examples include:

• X (Twitter) Ads conversion tracking (static.ads-twitter.com/uwt.js) – measures the effectiveness of our advertising on X. See X's Privacy Policy.
• Other advertising and remarketing pixels we may use from time to time (for example, Meta, Google Ads, LinkedIn) to reach people who have visited our Site.

You can opt out of many advertising cookies via industry tools such as the Your Online Choices portal (EU / UK) or the Network Advertising Initiative opt-out tool.

3. Tracking Technologies in Our Mobile Application

Mobile applications do not use HTTP cookies in the same way as websites, but they rely on similar technologies. The Karma mobile application uses:

• Local on-device storage (AsyncStorage and SecureStore) to save your session, app preferences, and security-related data on your device. SecureStore is encrypted and used for sensitive items (e.g. authentication keys, passkey references).
• Authentication and session tokens issued by Supabase and Turnkey to keep you signed in to your account and to authorize requests to our servers.
• Push notification tokens generated by Apple Push Notification Service (APNs) and Firebase Cloud Messaging (FCM) via Expo Notifications, so we can send you transaction alerts, security notices, and other notifications you have opted into.
• Device and operating system identifiers used for security, fraud prevention, crash diagnostics, and basic analytics.
• Mobile advertising identifiers (Apple IDFA on iOS and Google Advertising ID on Android), only where you have provided the consent required by Apple's App Tracking Transparency framework or your Android device settings.

The mobile app does not rely on third-party advertising cookies. You can control or reset mobile identifiers and push tokens through your device's operating system settings.

4. First-Party and Third-Party Cookies

First-party cookies are set by Karma directly when you visit the Site or use our Services.

Third-party cookies are set by domains other than karmapay.xyz. Third parties that may set cookies through our Site include:

• Google (Google Analytics and related products).
• X Corp. (X / Twitter Ads conversion tracking).
• Cloudflare and Vercel (security, performance, and content delivery).
• Embedded service providers (e.g. video, charting, or documentation widgets) that may set their own cookies when their content loads.

We do not control these third parties or how they use cookies. We encourage you to review their privacy and cookie policies for more information.

5. How Long Cookies Stay on Your Device

The cookies we use have different lifespans:

• Session cookies are temporary and are deleted automatically when you close your browser.
• Persistent cookies remain on your device for a set period or until you delete them. Persistent cookies we set generally expire within 13 months, in line with guidance from the UK Information Commissioner's Office (ICO) and EU data protection authorities. Third-party cookies may have different lifespans set by the third party.

6. Your Choices and How to Manage Cookies

You have a number of ways to control cookies and similar technologies:

• Cookie banner / preferences: Where we are required to obtain your consent, we present a cookie banner the first time you visit. You can change your preferences at any time using the "Cookie settings" link in our site footer or header.
• Browser settings: Most browsers allow you to refuse all cookies, accept only first-party cookies, or delete cookies that have already been set. The "Help" section of your browser will explain how. See, for example:
  • Google Chrome
  • Mozilla Firefox
  • Apple Safari
  • Microsoft Edge
• Mobile device settings: Your mobile operating system allows you to reset advertising identifiers, control push notifications, and limit ad tracking. On iOS, see Settings → Privacy & Security → Tracking and Settings → Privacy & Security → Apple Advertising. On Android, see Settings → Privacy → Ads.
• Industry opt-outs: You can opt out of many third-party advertising cookies using Your Online Choices (EU / UK) or the Digital Advertising Alliance (US).
• Do Not Track: Some browsers offer a "Do Not Track" signal. As described in our Privacy Policy, our Site does not currently respond to Do Not Track signals.

Please note that if you disable or refuse cookies, some parts of our Services may become inaccessible or may not function properly (for example, you may have to sign in more frequently or some features may not work as intended).

7. Legal Basis for Using Cookies

Where you are in the United Kingdom or European Economic Area, we rely on the following legal bases under the GDPR and PECR / ePrivacy rules:

• Consent for performance / analytics, functional, and targeting / advertising cookies that are not strictly necessary.
• Legitimate interests and performance of a contract for strictly necessary cookies that are required to operate the Site, authenticate you, prevent fraud, and provide the Services you have requested.

You can withdraw your consent at any time using the controls described in Section 6.

8. Personal Data Collected via Cookies

Some cookies may collect information that qualifies as personal data under applicable law (for example, IP addresses, device identifiers, or online identifiers). For details on how we handle personal data, your rights, and how to exercise them, please review our Privacy Policy.

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes to the cookies and similar technologies we use, or for other operational, legal, or regulatory reasons. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Cookie Policy periodically to stay informed about our use of cookies.

10. Contact Us

If you have any questions about our use of cookies or this Cookie Policy, please contact us:

If you are in the UK or EEA and are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or with your local EU data protection authority.