Cookie Policy

Last updated: 28 July 2026

This Cookie Policy explains how Immunefi uses Cookies and similar technologies on immunefi.com and its subdomains, what each one is for, and how You can control them. It supplements Our Privacy Policy, and the definitions used there apply here.

"Immunefi", "We", "Us" and "Our" refer to Immunefi, the DBA name of Immuni Software PTE LTD, Singapore.

Cookies are small text files that a website asks Your browser to store on Your Device. They are widely used to make a site work, to remember Your settings, and to measure how a site is used.

This Policy also covers technologies that behave like Cookies even though they are not Cookies in the strict sense:

• Local storage and session storage. Data held by Your browser for a site, which is not sent with every request the way a Cookie is.
• Pixels and web beacons. Small requests for an image or a script that let a third party record that a page was loaded.
• Software development kits and tags. Third-party code that runs on a page and may itself set Cookies.

Where this Policy says "Cookies", it means all of the above.

On Your first visit We set no analytics or advertising Cookies, and We do not send the third-party tags that would set them. They are absent from the page rather than present and switched off, so nothing optional can run before You have made a choice, including if part of Our own code fails.

Strictly necessary Cookies are set without asking, because they are required to deliver a service You have requested. This is permitted without consent under EU and UK Cookie rules.

If You take no action, nothing optional is enabled. Ignoring or closing the Cookie notice is not treated as agreement.

Strictly necessary

Required to deliver the site and keep it secure, and to remember the Cookie choice You made. These cannot be switched off, and We do not ask for consent to set them.

Analytics

Helps Us understand which pages are used and where people run into trouble, so We can improve them. This category also covers Our A/B tests, which compare two versions of a page to see which is clearer.

Advertising

Measures the performance of Our advertising and allows advertising platforms to recognise Your browser across other sites so that campaigns can be attributed and audiences built. This is the category most likely to involve sharing data with third parties.

Session recording

Records how a visitor moves through a page, including mouse movement, scrolling and clicks, so We can find parts of the site that are confusing. Text You type into form fields is masked in Your browser before the recording is sent to Us. Session recording is only available when Analytics is also enabled, because it relies on the same service.

The table below is generated from the same configuration that enforces Your choice, so it describes what actually runs rather than a separate list kept by hand.

Third parties named above set their Cookies under their own terms. Their retention periods are the maximums those providers document and may change without notice to Us.

We use Plausible Analytics to count visits. It runs for every visitor, including visitors who refuse every optional category, and it is therefore not listed as a consent category above.

We rely on it because it is designed not to require consent:

• It sets no Cookies and writes nothing to Your browser's storage.
• It does not create an identifier for You and cannot follow You between sites.
• It reports only aggregate figures, such as how many people viewed a page.
• It is served from Our own domain rather than by a third-party script.

Our lawful basis for this processing is Our legitimate interest in understanding, at an aggregate level, whether Our site works. We also use Sentry to record errors and to protect the service against abuse, which We treat as strictly necessary for security and service integrity.

Select Cookie preferences in the footer of any page. From there You can turn individual categories on or off, or select Reject all to turn everything optional off in a single action.

Withdrawing is immediate:

• We delete the Cookies and browser storage listed above for any category You turn off.
• We stop sending the corresponding third-party tags.
• If advertising tags were already running on the open page, the page reloads, because those tags cannot reliably be shut down once started.

Withdrawing consent does not undo processing that already took place while consent was in force. To ask about data already collected, including a request to erase it, contact Us using the details below.

We honour Global Privacy Control, a setting some browsers and extensions send to tell every site that You do not want Your data shared for advertising.

When We receive that signal, Advertising is switched off and We keep it off, even if a stored choice from an earlier visit said otherwise. You can still enable Advertising explicitly in Cookie preferences, and that later choice takes precedence for as long as it stands.

Global Privacy Control applies to advertising only. It says nothing about Analytics or Session recording, so We still ask You about those.

We do not act on the older Do Not Track header, which was never agreed as a standard and is interpreted inconsistently across browsers.

You can also control Cookies in Your browser, independently of the choice You make on Our site. Every major browser lets You block or delete Cookies, and provides instructions in its own help pages: Chrome, Safari, Firefox and Edge.

Blocking all Cookies will stop Us from recording Your Cookie choice, so You may be asked again on every visit. Blocking strictly necessary Cookies may stop parts of the site from working.

Some browser extensions block third-party tags before they load. Where that happens, the effect is the same as refusing the relevant category.

Where a third party listed above sets its own Cookies, that provider acts as an independent controller for the data it collects, and its own notice governs it. Consult their notices for details of their processing: Google, LinkedIn, X, Reddit, PostHog and Segment.

Several of these providers are located outside the European Economic Area and the United Kingdom, so enabling those categories may involve transferring Your data to those countries. Our approach to safeguarding such transfers is described in Our Privacy Policy.

Your choice is stored in the ifi_consent Cookie for 12 months, after which We ask again. The Cookie records which categories You allowed, when You decided, and which version of this Policy was in force at the time.

We also ask again, before that period ends, if We materially change what We use Cookies for. Until You answer, every optional category is treated as refused.

We may update this Policy to reflect changes in the technologies We use or in the law. When a change materially affects what You agreed to, We reset stored choices and ask again rather than relying on Your earlier answer.

For questions about this Cookie Policy or about Your privacy rights:

• By email: privacy@immunefi.com