Cookie Policy

01Strictly necessary cookies

We set a session cookie after you sign in. It keeps you authenticated across pages and is removed when you sign out or when it expires.

We set a CSRF protection cookie on state-changing operations to prevent cross-site request forgery.

• mt5bot_session — authenticated session token, HttpOnly, Secure, SameSite=Lax, validity up to 30 days;
• mt5bot_csrf — CSRF token, Secure, SameSite=Strict, valid for the duration of the session;
• mt5bot_analytics_consent — stores your analytics-consent choice ("1" accepted, "0" declined), SameSite=Lax, 1-year validity.

02Product analytics (opt-in)

If you accept via the banner, we load PostHog (EU hosted, Frankfurt) to track pageviews and product events anonymously or pseudonymously (person_profiles: identified_only). If you decline, the PostHog script is never even downloaded. You can change your choice at any time from this page (see the toggle below).

Related third-party cookies, only set after consent:

• ph_<project>_posthog — PostHog user id (pseudonymous), 1-year expiry;
• ph_<project>_posthog_feature_flags — cache of active feature flags, session expiry.

03Third-party cookies

The service does not load third-party scripts that set cookies on mt5bot.io. Payment pages are handled entirely on Stripe and PayPal domains, which set their own cookies only on their own domains.

04Your choices

Because we only use strictly necessary cookies, no in-product consent is required. You can disable cookies via your browser settings, but the service will not be usable — authentication requires the session cookie.

05Future changes

If we add analytics or optional cookies in the future, we will update this policy and display an opt-in consent banner as required by EU law. Existing users will be notified by email.

06Contact

Questions about cookies: privacy@mt5bot.io.